Email Security Report

How secure is a domain’s email?

One check for every standard: who may send, whether mail is signed, the spoofing policy, encryption in transit, and the DNS underneath. Each gets its own verdict; there is no score to game.

Guide

How to read the report

Each line is one standard, with the most important finding for it. Follow the link for the full breakdown.

  • Error means something is broken or missing in a way that affects delivery or lets the domain be spoofed.
  • Warning means it works but is weaker than it should be, such as a DMARC policy of p=none.
  • Not verifiable means a browser cannot see enough to judge, and says what to check by hand: DKIM selectors that cannot be listed, policy files served without CORS, certificates that need an SMTP connection.

There is deliberately no overall score. SPF, DKIM and DMARC protect against spoofing; MTA-STS, TLS-RPT and DANE protect mail in transit; BIMI is branding. A domain can be excellent at one and absent at another, and an average would hide exactly that.

A sensible order to fix things in: SPF, then DKIM, then DMARC through to p=reject, then TLS-RPT and MTA-STS.

FAQ

Email Security Report: common questions

What does an email security check cover?

This report checks the MX records that receive mail, SPF and DKIM which authenticate it, DMARC which tells receivers what to do with mail that fails, MTA-STS, TLS-RPT and DANE which protect mail in transit, BIMI for brand logos, and the health of the DNS everything depends on.

Why is there no overall score?

Because the standards protect against different things, and an average hides the gaps. A domain with perfect SPF and no DMARC is still easy to spoof. Each standard gets its own verdict instead, with the most important finding.

Is anything sent to a server?

No. Every check runs in your browser and queries public DNS over HTTPS. Nothing is stored, and the domain you check is not logged by this site.

Guides

Learn more