Email Authentication
Health Scanner
Check SPF, DKIM, DMARC and related email-domain settings. Find issues, understand the evidence, and get clear, actionable insights.
Free · No sign-up required · Evidence-aware results · Takes a few seconds
example.com
Last scanned: Apr 28, 2025 at 10:24 AM UTC
Authentication health score
Your domain has solid authentication setup with a few areas to improve.
Protocol status
Top issues (3)
- 1DMARC policy is monitoring only
Consider moving to quarantine or reject for stronger protection.
- 2BIMI record not configured
Add a BIMI record to display your brand logo in supported email clients.
- 3SPF lookup budget is high
Your SPF record uses 9 of 10 DNS lookups. Consider simplifying.
Detailed Findings
Detailed analysis results for each email authentication protocol.
SPF
ValidValid SPF record found with 9/10 DNS lookups.
Authorizes your sending servers.
View detailsDKIM
ValidValid DKIM record(s) found.
1 selector configured.
View detailsDMARC
MonitoringDMARC record found (p=none).
Consider a stricter policy after reviewing reports.
View detailsBIMI
Not configuredNo BIMI record found.
Add a BIMI record to display your logo.
View detailsMTA-STS
ValidValid MTA-STS policy found.
Your domain is protected with MTA-STS.
View detailsTLS-RPT
ConfiguredTLS-RPT record found.
Receiving reports from supported servers.
View detailsTechnical Details
In-depth technical information, DNS records, and evidence for each protocol.
Sample fixture only. Raw DNS records will appear after a live scan.
Evidence available: Public DNS, Configuration.
Sample fixture only. Selector and key evidence will appear after a live scan.
Evidence available: Public DNS, Configuration.
Sample fixture only. Parsed policy and aggregate evidence will appear after a live scan.
Evidence available: Public DNS, Configuration.
Sample fixture only. BIMI readiness evidence will appear after a live scan.
Evidence available: Public DNS.
Sample fixture only. Policy and mode evidence will appear after a live scan.
Evidence available: Public DNS, Configuration.
Sample fixture only. Reporting endpoint evidence will appear after a live scan.
Evidence available: Public DNS, Configuration.
Recommended Next Steps
Based on your results, here are the most important next steps.
- 1
Review DMARC enforcement
Review aggregate reports and confirm legitimate senders before increasing enforcement.
- 2
Set up a BIMI record
Add a BIMI record to display your brand logo in supporting inboxes.
- 3
Monitor TLS-RPT reports
Review reports to identify TLS issues over time.
Next Tools
Continue with these tools to further improve your email setup.
FAQ
Common questions about email authentication.
SPF is a DNS record that identifies servers allowed to send email for a domain. It helps receivers evaluate whether a message came from an authorized source.
DKIM adds a cryptographic signature to email. Receivers can verify that signed parts of a message have not changed and that the signing domain is authorized.
DMARC tells receivers how to handle messages that fail alignment checks and enables aggregate reporting. It builds on SPF and DKIM.
BIMI is a standard for displaying a verified brand logo in supporting inboxes. Its requirements depend on your domain’s authentication and policy setup.
MTA-STS helps mail systems enforce encrypted SMTP connections for a domain through a DNS record and a hosted policy.
TLS-RPT provides reporting addresses for delivery issues related to encrypted SMTP connections, helping teams investigate transport failures.
Keep Your Email Infrastructure Healthy
Run a new scan anytime to check for changes and make sure your domain stays protected.
Free · No sign-up required · Evidence-aware results