How this works
- Every check is a public DNS lookup
- SPF, DMARC, DKIM, MX, MTA-STS and TLS-RPT are all published records that any mail server on the internet reads before accepting mail from you. We read the same ones. Nothing is scanned, probed or connected to.
- We do not touch your mail
- No message is sent, no server is contacted, no port is opened. If you ran this against a domain you do not own, its owner would see nothing, because nothing happened to them.
- One domain at a time, on purpose
- There is no bulk input and no list upload. A tool that grades a thousand domains at once is a target list, and we are not building one.
- Results are temporary and unlisted
- Result pages carry noindex and expire on their own. We do not publish a directory of spoofable domains.
SPF
Sender Policy Framework. A list, published in your DNS, of the servers allowed to send email using your domain name. Receiving mail servers check incoming mail against it.DMARC
The instruction you give the rest of the internet about what to do with mail that claims to be from you but fails the checks: let it through, put it in spam, or refuse it. Without DMARC, each receiver guesses.DKIM
A cryptographic signature added to every message you send, which proves it really came from you and was not altered on the way. Unlike SPF, it survives being forwarded.MX
The DNS record naming the servers that receive mail for your domain. It tells us who runs your email, which is how we know whose admin console the fix instructions should describe.MTA-STS
A published policy telling other mail servers they must use encryption when delivering to you, and must not silently fall back to sending in the clear if it fails.TLS-RPT
An address where other mail providers send you a daily report whenever encrypted delivery to your domain fails. It costs nothing and breaks nothing.spoofing
Sending an email that displays someone else's address in the From line. On a domain with no DMARC enforcement, this takes no skill and no access to your systems.