Services AI Systems & Intelligent Automation Cloud Platforms & Enterprise Architecture Cybersecurity, Identity & Governance Systems Integration & Business Automation Intelligent Web Platforms Infrastructure & Networking Managed Technology Services Case Study Industries Free tools About Contact Talk to an Architect
  1. Home
  2. Free tools
  3. Email health check
Tool 01 · Email authentication

Can someone send email as your domain?

Enter a domain to check its MX, SPF, DKIM, DMARC, MTA-STS and TLS-RPT records. You get a grade, the records themselves, and what to change. Nothing is sent to your mail servers.

Results are indicative and based on public DNS and HTTP responses at the moment you run the check. They are not a security audit or a compliance finding. See the terms.

Reading the result

What each check means, and what good looks like.

MX

MX records say which servers receive mail for the domain. The tool resolves each one and identifies the provider, such as Google Workspace, Microsoft 365, Proofpoint or Mimecast. A domain that sends no mail at all should publish a null MX so nobody tries to deliver to it.

SPF

SPF is a TXT record listing the servers allowed to send mail using your domain in the envelope. The tool expands every include: and counts the DNS lookups, because the standard allows a maximum of ten; beyond that, receivers return a permanent error and treat your mail as unauthenticated. This is the single most common SPF problem we see, usually caused by years of adding marketing, CRM and invoicing platforms without ever removing one.

  • Exactly one record starting v=spf1. Two records is the same as none.
  • Ends with -all (fail) or ~all (softfail). +all lets anyone send as you.
  • Google Workspace uses include:_spf.google.com; Microsoft 365 uses include:spf.protection.outlook.com.

DKIM

DKIM signs each message with a private key; receivers verify it against a public key published under a selector in DNS. Because selectors are chosen by the sending platform, the tool tries the common ones (Google uses google, Microsoft 365 uses selector1 and selector2, plus the defaults used by Mailchimp, SendGrid, HubSpot, Zendesk, Fastmail and others). If yours is different, enter it in the selector field. Keys should be RSA 2048-bit; anything under 1024 is ignored by receivers.

DMARC

DMARC ties SPF and DKIM to the From address people actually see and tells receivers what to do when neither passes. The policy matters:

  • p=none: monitor only. Reports are collected but spoofed mail is still delivered. This is where most domains stop, and it provides no protection.
  • p=quarantine: failing mail goes to spam.
  • p=reject: failing mail is refused. This is the end state.

The rua= tag names where aggregate reports are sent. Without it you cannot see who is sending as your domain, which is the information you need before moving from none to reject. If reports go to a third-party service, that service's domain has to publish an authorisation record; the tool checks that too.

MTA-STS, TLS-RPT and BIMI

MTA-STS tells sending servers to require TLS when delivering to you, closing the downgrade gap that plain SMTP leaves open. TLS-RPT gives you a report when they could not. Both are optional and both are supported by Microsoft 365 and Google Workspace. BIMI displays your logo beside authenticated mail in some inboxes and requires DMARC at quarantine or reject first. None of the three affects the grade much; they are the polish once authentication is in place.

How the grade is calculated

DMARC carries the most weight (30 points), then SPF (25), DKIM (20) and MX (15), with MTA-STS, TLS-RPT and BIMI making up the last 10. A domain with valid SPF, a DKIM key and DMARC at reject scores an A. A domain with DMARC at none tops out around a C, because monitoring alone does not stop spoofing.

Common questions

We use Microsoft 365. Why does DKIM show as not found?
DKIM is not enabled by default for custom domains in Microsoft 365. In the Defender portal, open Email authentication settings, select the domain and enable DKIM signing; it gives you two CNAME records to publish. Once they are in place, selector1 and selector2 will appear here.
Our marketing platform sends as our domain. Does it need its own DKIM key?
Yes. Each platform that sends mail with your domain in the From address needs its own DKIM key (and usually an SPF include). Otherwise its messages fail DMARC once you move to quarantine or reject. Enter the platform's selector in the field above to confirm the key is published.
Why does the tool say my SPF record has too many lookups when it looks short?
Each include pulls in the includes of the record it points to. A single include for a large provider can cost four or five lookups on its own. The include chain in the result shows exactly where they go.
Is DMARC at p=none better than nothing?
Slightly: it gets you reports. But it does not stop anyone spoofing the domain. Treat it as a starting point with a date to move on, not a destination.
Does this check send anything to my mail server?
No. Every check is a DNS query, plus one HTTPS fetch of the MTA-STS policy file if the DNS record for it exists.
Analyse a message's headersLook up DNS recordsCheck the website
Next step

Move to p=reject without breaking legitimate mail.

We inventory every platform that sends as your domain, publish the SPF, DKIM and DMARC records, read the reports, and step the policy up only when everything passes. For Microsoft 365, Google Workspace and everything that sends alongside them.

Discuss Your Environment Email and identity security