Check your domain for DMARC, SPF, MX, DKIM, BIMI, TLS-RPT, MTA-STS, and other email security records.
How It Works
The tool queries public DNS servers then parses the relevant email authentication records. The results are then fed into a policy engine that highlights broken syntax, weak policy, and missing protections.
Issue Detection
The checker looks for the failures that usually block DMARC enforcement, reduce deliverability, or leave gaps in your sender authentication setup.
These are the rule sets currently used by the checker for DMARC, SPF, and DKIM analysis.
| Title | Description | Documentation |
|---|---|---|
| SPF Record Existence | No SPF record found for the domain. | RFC 7208 - Sender Policy Framework: SPF Records |
| Invalid Version Tag | The record does not start with 'v=spf1'. | RFC 7208 - SPF Records |
| Multiple SPF Records | Multiple SPF records were found for the domain. | RFC 7208 - Multiple DNS Records |
| DNS Lookup Limit | The SPF record requires more than 10 DNS lookups to resolve. | RFC 7208 - DNS Lookup Limits |
| Void DNS Lookup Limit | The SPF record triggered more than 2 void DNS lookups (lookups returning empty answers/NXDOMAIN). | RFC 7208 - DNS Lookup Limits |
| MX DNS Lookup Limit | The SPF record uses an 'mx' mechanism that contains more than 10 entries. | RFC 7208 - MX Mechanism |
| Top-level missing 'all' or 'redirect' | The top-level SPF record does not contain an 'all' mechanism nor a 'redirect' modifier. | RFC 7208 - Default Result |
| Nested SPF record missing 'all' or 'redirect' | One or more SPF records referenced through include or redirect do not contain an 'all' mechanism nor a 'redirect' modifier. | RFC 7208 - Default Result |
| Permissive 'all' Mechanism | The record ends with '+all' (pass all). | RFC 7208 - The 'all' Mechanism |
| Usage of 'ptr' Mechanism | The 'ptr' mechanism is used in the SPF record. | RFC 7208 - 'ptr' (do not use) |
| Syntax Error in Mechanism | One or more mechanisms in the SPF record contain syntax errors. | RFC 7208 - Mechanism Definitions |
| Unknown Modifier | The record contains an unknown modifier (not 'redirect' or 'exp'). | RFC 7208 - Modifier Definitions |
| Title | Description | Documentation |
|---|---|---|
| DKIM Public Key | No public key found in the DKIM record. | RFC 6376 - DKIM Key Representation |
| DKIM Key Length | RSA key is less than 1024 bits. | RFC 8301 - Cryptographic Algorithm Recommendations |
| DKIM Testing Mode | Testing mode flag (y) is set in the DKIM record. | RFC 6376 - Key Flags |
| DKIM Deprecated Hash Algorithm | The DKIM record only allows SHA-1 hash algorithm. | RFC 8301 - Cryptographic Algorithm Recommendations |
| Title | Description | Documentation |
|---|---|---|
| DMARC Record Existence | No DMARC record found for the domain. | DMARC Defender - Quick Start GuideRFC 7489 - DMARC Policy Record |
| Invalid DMARC Version | The DMARC record does not start with 'v=DMARC1'. | RFC 7489 - DMARC Version |
| Missing DMARC Policy | No policy (p) tag found in the DMARC record. Without a policy, DMARC is not enforcing any actions on unauthenticated emails. | RFC 7489 - DMARC Policy |
| Invalid DMARC Policy Ordering | DMARC policy (p) tag is not the first tag after the version. | RFC 7489 - DMARC Policy |
| Unknown or non-standard DMARC Tag | The DMARC record contains an unknown or non-standard tag. | RFC 7489 - DMARC Policy |
| Weak DMARC Policy | DMARC policy is set to 'none', which only monitors without enforcing. | RFC 7489 - Policy Actions |
| Partial DMARC Enforcement | DMARC policy applies to less than 100% of emails. | RFC 7489 - Percentage Tag |
| No Aggregate Reports Configured | No aggregate report URI (rua) is configured. | RFC 7489 - Aggregate Reports |
| Subdomain Policy on Subdomain | The 'sp' tag is set on a subdomain DMARC record where it has no effect. | RFC 7489 - Subdomain Policy |
| Weak Subdomain Policy | Subdomain policy is weaker than the main domain policy, leaving subdomains less protected. | RFC 7489 - Subdomain Policy |
| External Destination Check | If sending DMARC reports to a separate domain, that domain must specify through DNS it is willing to receive reports. | RFC 7489 - Verifying External Dependencies |
| Title | Description | Documentation |
|---|---|---|
| BIMI Record Existence | No BIMI record found for the domain. | IETF BIMI Draft - Publish Assertion Records |
| Invalid BIMI Version | The BIMI record does not start with 'v=BIMI1'. | IETF BIMI Draft - Assertion Record Definition |
| Unknown or non-standard BIMI Tag | The BIMI record contains an unknown or non-standard tag. | IETF BIMI Draft - Assertion Record Definition |
| Missing BIMI Logo URI | BIMI record exists but is missing the required logo URI ('l=') tag. | IETF BIMI Draft - Indicator Discovery |
| Missing BIMI Authority URI | BIMI record exists but is missing the authority URI ('a=') tag for certificate evidence. | IETF BIMI Draft - Assertion Record Definition (a= Authority Evidence Location) |
| BIMI Logo URI Does Not Resolve | The BIMI logo URI does not resolve. | IETF BIMI Draft - Indicator Discovery Without Evidence |
| BIMI Authority URI Does Not Resolve | The BIMI authority URI does not resolve | IETF BIMI Draft - Assertion Record Definition (a= Authority Evidence Location) |
| Title | Description | Documentation |
|---|---|---|
| TLS-RPT Record Existence | No TLS-RPT record found for the domain. | RFC 8460 - SMTP TLS Reporting |
| Invalid TLS-RPT Version | The TLS-RPT record does not start with 'v=TLSRPTv1'. | RFC 8460 - DNS Record Syntax |
| Missing TLS-RPT rua | TLS-RPT record exists but is missing a valid report URI list ('rua='). | RFC 8460 - rua Tag |
| Unknown TLS-RPT Tag | The TLS-RPT record contains unknown or non-standard tags. | RFC 8460 - DNS Record Syntax |
Coverage
The checker focuses on the public DNS records that control email authentication, brand trust, and transport protection.
FAQ
The tool is intentionally simple: public DNS in, actionable analysis out.
Get Started Today
Get started for free.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。