Email domain checker
Check SPF, DKIM, DMARC, DNSSEC and CAA for any domain and see what to fix. Only public DNS is read: no login, nothing to install.
What the checks mean
SPF
A TXT record on the domain listing the servers allowed to send its mail. Receivers check the sending server against it. A domain may have only one SPF record, and evaluating it may take at most 10 DNS lookups; beyond that SPF fails for every message. End it with "-all" (reject the rest) or "~all" (mark the rest).
DKIM
Your mail server signs each message with a private key; the public key sits in DNS under a selector (selector._domainkey.yourdomain). Receivers verify the signature, so the message provably came from you and was not changed. Selectors cannot be listed, so this tool tries the ones common providers use.
DMARC
A TXT record at _dmarc.yourdomain that tells receivers what to do with mail that fails SPF and DKIM alignment: nothing (p=none), spam folder (p=quarantine) or reject (p=reject), and where to send reports (rua). Start with none to read the reports, then move to quarantine and reject.
MTA-STS and TLS-RPT
MTA-STS tells sending servers to deliver to you only over TLS with a valid certificate; TLS-RPT sends you reports when they could not. Both are optional hardening on top of SPF, DKIM and DMARC.
DNSSEC
Signs the domain's DNS records so resolvers can detect forged answers. Optional, but when it is published it must validate: a broken signature or a stale DS record at the registrar makes the whole domain unreachable for validating resolvers.
CAA
A DNS record naming the certificate authorities allowed to issue TLS certificates for the domain. Without it any public CA may issue one; with it, a CA not on the list must refuse.
Go further
- DMARC record generatorAnswer a few questions and get a DMARC record to paste into DNS.
- SPF record generatorPick the services that send your mail and get one valid SPF record.
- Microsoft 365 tenant lookupFind the tenant ID behind any domain, its region, cloud and sign-in type.
- Microsoft 365 security checksEvery CIS check for Microsoft 365, explained
- All free tools6 no-login helpers for admins
Check more than one domain
ConfigCobra assesses your Microsoft 365 tenant against the CIS Microsoft 365 Foundations Benchmark, read-only.