Your files stay on your device

Email security checker

Run MX, SPF, DMARC, DKIM and DNSSEC checks for a domain in one pass and score them, never counting an unavailable check as a failure.

Press the button to run the checks

Nothing leaves this page until you do. Five checks run in one pass: MX, SPF, DMARC, DKIM with your selector, and DNSSEC. A missing record reads as not configured, not failed, and sits out of the score.

This is a DNS read, not a mail audit. It leaves out BIMI, MTA-STS, and TLS-RPT on purpose; MTA-STS has its own checker on this site. Selector discovery without a hint is genuinely impossible, which is why the empty selector path reports DKIM as not configured instead of failing it. DNSSEC is checked by DNSKEY record presence only, not cryptographic validation.

Domain

DomainOne hostname per run, like example.com

DKIM selectorLeave empty to skip the DKIM lookup honestly instead of failing it

More settings

DNS resolverWhere the five checks ask their questions

All five checks fire at once against a shared 8 second budget. A check that misses the budget reports as unable to check, never as failed.

What leaves your browser

Five DNS questions (MX, TXT, _dmarc TXT, the selector's _domainkey TXT, DNSKEY) go browser-direct to the DoH resolver you picked. The domain name is visible to that resolver. This page leaves your browser only when you press the button; never on load, never in the background. Nothing is sent anywhere else. Google Analytics still measures the visit to this page, and it never receives what you run through this tool.

All network tools

Was this tool useful?

Email security checker

More network tools