Check a domain's email authentication

SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI, with the things generic checkers miss: the RFC 7208 ten-lookup limit, whether an MTA-STS policy actually exists behind the DNS record that promises it, and whether the policy covers the MX hosts that are live right now.

What it checks

SPF

Beyond whether a record exists: the qualifier it ends on, whether more than one is published (which is a permerror, not a merge), and the RFC 7208 lookup count. For the full include tree and the mechanism that tips a record over the limit, use the SPF lookup counter.

DMARC

Policy strength, subdomain policy, pct, and whether an aggregate reporting address is set. The common failures are a policy left at p=none where it blocks nothing, enforcement with no rua so there is no way to see what is being enforced, and sp=none under an enforcing p, which leaves every subdomain spoofable while the main domain looks protected.

DKIM

Selectors are arbitrary strings chosen by the sender. Probing a list of common ones and finding nothing proves nothing, so a miss is reported as inconclusive rather than as absent. Where a key is found, the approximate key length is reported, because keys under 1024 bits are rejected outright by several receivers.

MTA-STS

The DNS record is a promise that a policy exists at https://mta-sts.<domain>/.well-known/mta-sts.txt. If that URL 404s the entire mechanism is inert while appearing configured, and a DNS-only checker will call it enabled. This one fetches the policy, parses it as the key: value format RFC 8461 actually specifies, and compares the MX hosts it lists against the MX records that are live. Under enforce, mail to an uncovered MX host is refused.

Bulk sender readiness

A composite verdict against the Gmail, Yahoo and Microsoft requirements for senders over 5,000 messages a day. Two of those requirements, one-click List-Unsubscribe and a complaint rate under 0.3%, are not visible from DNS, so the report says so rather than guessing.

Your domain is never sent to this site

In your browser. The DNS lookups go from your machine to a public DNS-over-HTTPS resolver, not through this site, so the domain you type is never sent here and there is nothing to log. The one exception is the MTA-STS policy file: a page cannot fetch a URL on another origin, so that single request is proxied, and the endpoint takes a domain rather than a URL so it cannot be used to fetch anything else.

Same logic as dmarcsight, the command-line version, checked against it on every build.