Skip to content
Free tool

Email Authentication Check

Check the DNS records that protect your domain from spoofing. Type a domain: the tool reads its SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI records and three blocklists, and gives you the records to paste. No installation, no account.

Before you start

You give
One domain name.
It reads
The domain's public DNS records and three domain blocklists.
It keeps
The result for five minutes. Your email and the scan summary for 24 months, only if you ask for the full report.
Who sees the result
Anyone who enters the same domain: DNS is public, and every domain has its own report page.
Why it is free
Free because these checks show how I work. If a result needs fixing, I scope that as a fixed-scope job.

What you get back

Sample records, not a live scan

What the tool shows for example.com with a common half-done setup: SPF with ~all, DMARC only monitoring, one DKIM key. The score comes from the same points table a live scan uses.

010066/ 100
Authentication & transport checks
SPF~all · 2/10 lookups
DMARCp=none · pct=100
DMARC ruaConfigured
DKIM1 selector(s): selector1
MTA-STSMissing
TLS-RPTMissing
BIMINot published-
MXMicrosoft 365
BlacklistClean (3 lists)

Live DNS queries · No account needed · Result in under 5 seconds

How the score is calculated

Points by record, out of 100.

The score adds the points below. The band names the range it falls in. Both come from the same table the scan uses, so this page and your number cannot disagree.

90 to 100
Secure
70 to 89
Moderate
40 to 69
High risk
0 to 39
Critical
  • SPF+15an SPF record is published
  • SPF+5it ends in -all
  • SPF+3or it ends in ~all
  • SPF+5it is a single record within the 10-lookup limit
  • DMARC+10a DMARC record is published
  • DMARC+15the policy is p=reject
  • DMARC+10or p=quarantine
  • DMARC+3or p=none
  • DMARC+5aggregate reports go somewhere (rua=)
  • DMARC+5an enforcing policy applies to all mail (pct=100)
  • DKIM+10a DKIM key is found on a probed selector
  • DKIM+5a key is 2048 bits or longer
  • MTA-STS+3the MTA-STS TXT record is published
  • MTA-STS+5the policy is in enforce mode
  • MTA-STS+2or in testing mode
  • TLS-RPT+4a TLS-RPT record is published
  • BIMI+3a BIMI record is published
  • Blocklists+10the domain is on none of the three domain blocklists
What the scan reads
SPF
TXT @

The servers allowed to send as your domain. The tool reads the all qualifier (+, ~ or -), counts DNS lookups against the limit of 10 and flags a second SPF record.

DMARC
TXT _dmarc

What a receiver does with mail that fails SPF and DKIM alignment: the p= policy, pct= and whether rua= reports go anywhere. A subdomain falls back to the record of its parent.

DKIM
TXT selector._domainkey

The signing key. The tool probes 29 common selectors and reads the key length of each one it finds.

MTA-STS
TXT _mta-sts and the policy file

Whether senders must use TLS to reach you: the TXT record and the mode in the policy file.

TLS-RPT
TXT _smtp._tls

Where reports of TLS delivery failures go.

BIMI
TXT default._bimi

A brand logo record, and whether it carries a certificate. Optional: it adds 3 points.

MX
MX @

The mail servers, and the provider they belong to. The suggested SPF record follows the provider.

Blocklists
three domain lists

Whether the domain is listed on Spamhaus DBL, SURBL or the SpamEatingMonkey URIBL.

How it works

  1. Live DNS lookup

    The tool queries DNS live when you scan, through this site's DNS resolver. Each result is kept for five minutes per domain, then it expires.

  2. Policy analysis

    The SPF all qualifier, the DMARC p= policy and rua= reporting are parsed and scored against the DNS side of the Google, Yahoo and Microsoft bulk-sender rules.

  3. Records to paste

    Each issue comes with the TXT record to paste into your DNS panel, with the SPF include for the mail provider the scan found.

Frequently asked
Is this tool really free?

Yes, and there is nothing to buy. The scan, the score and the headline fixes run on live DNS and are free. If you give us an address, the full report, with DKIM, blacklist and reputation analysis, is drafted by an AI model and emailed to you automatically; no person reviews it before it is sent. We keep your email and the scan summary for 24 months (Privacy Policy, section 2).

Do you store my domain or email?

The scan runs on the server. Each result is kept for five minutes, keyed by the domain, so a repeat scan is quick, then it expires. Your email and the scan summary are kept only if you ask for the full report by email.

Why does SPF alone score at most 35 of 100?

SPF authenticates the envelope sender, not the visible From: header. Without DMARC, an attacker can put your domain in the From: address and most mail clients will show the message as yours. The points table above shows where the rest of the score comes from.

Google and Yahoo now require DMARC. Does this tool check that?

Yes. Since February 2024 bulk senders must publish DMARC. The score reads DNS records only: SPF, the DMARC policy and DKIM. The bulk-sender rules also cover one-click unsubscribe, spam complaint rate and reverse DNS, which a DNS scan cannot see. A 100 means the records are in place, not that you meet every requirement.

What about DKIM?

DKIM keys sit under a selector the sending service chooses. The tool probes 29 common selectors (Microsoft 365, Google, Mailgun, SendGrid, Zoho, Postmark, Amazon SES and more) and reads the key length of each one it finds. A custom selector that is not on that list is not found, and the report lists the selectors it tried.

Set up SPF and DMARC once, properly.

The scan tells you what is wrong and gives you the record to paste. If you would rather I made the change and moved DMARC to enforcement, I scope it as a fixed job inside tenant hardening.

See mail authentication in tenant hardeningBook a 30-minute call