How securely is a domain’s email configured?

• Email Security Report Runs every check at once and gives one verdict per standard, linking to the detail.
• MX Lookup Mail servers, priorities and addresses, with checks that each one can actually receive mail.
• SPF Checker Validates SPF syntax, counts DNS and void lookups across nested includes, and explains every term.
• DMARC Checker Validates DMARC against RFC 9989: tree-walk discovery, obsolete pct/rf/ri tags, t= testing, np= and report authorisation.
• MTA-STS Checker Checks the _mta-sts record, the HTTPS policy host and certificate, policy mode and max_age, and MX coverage.
• TLS-RPT Checker Validates the _smtp._tls record and its mailto: and https: report destinations.
• DANE Checker Checks DNSSEC validation for the domain and TLSA records at _25._tcp for every MX host.
• BIMI Checker Validates the default._bimi record and the DMARC enforcement BIMI requires.
• DKIM Checker Looks up DKIM keys by selector, or tries common ones, and checks key type, length and revocation.
• DNS Checker Checks nameserver count, addresses and network spread, SOA timers, and DNSSEC.

SPF, DMARC, TLS-RPT, BIMI and the DNS halves of MTA-STS and DANE are public DNS records, and are checked in full. Some things are not visible from a web page: DKIM keys sit under selectors that cannot be listed, MTA-STS policy files and BIMI certificates are usually served without the headers a browser needs to read them, and a TLSA record can only be matched against a certificate over an SMTP connection. Those are marked Not verifiable rather than counted as passing.