What this tool checks
Email security rests on four DNS-based pieces: SPF says which servers may send for your domain, DKIM signs your mail so it can't be tampered with, DMARC tells receivers what to do with mail that fails those checks, and MX shows where your mail is delivered. This tool checks all of them, plus common blacklists, and gives you a graded scorecard with the actual records so you know exactly what to fix.
From a passing scorecard to real protection
A green scorecard means SPF, DKIM, and DMARC all exist, but existing isn't the same as enforcing. The finish line is a DMARC policy of quarantine or reject with aligned SPF and DKIM behind it; a domain sitting at p=none is only watching, not blocking. Once that's solid, the next hardening steps are MTA-STS and TLS-RPT to protect mail in transit, plus keeping your sending IPs off blacklists. The catch is that this setup drifts: every new SaaS tool you let send on your behalf can quietly weaken it.
Frequently asked questions
How is the grade calculated?
The score is out of 100 across five equally weighted checks worth 20 points each: MX, SPF, DMARC, DKIM, and blacklist status. Each earns full points when it passes, half when it's present but weak (for example DMARC at p=none, which only monitors), and none when it's missing. The letter grade maps from that total, so a domain with SPF, DKIM, an enforcing DMARC policy, and clean sending IPs scores highest.
Why does email security matter?
Without SPF, DKIM, and DMARC, anyone can send email that appears to come from your domain. That fuels phishing and lands your real mail in spam. Getting all three right protects your brand and your deliverability.
What's a good score?
An A means SPF, DKIM, and DMARC are all present and enforcing. Most gaps are a missing or permissive DMARC policy (p=none) or no DKIM at common selectors. The scorecard shows which piece is dragging you down.
It says no DKIM found, but I have it.
DKIM uses a named selector, and this tool probes the common ones. If you use a custom selector, your DKIM may still be valid even if it isn't auto-detected here.
My score was an A last month. Why check again?
Email configuration drifts. Adding a new marketing platform, help desk, or CRM that sends as your domain can break alignment, a provider can rotate a DKIM key, or a record can be edited by mistake. Re-checking (or monitoring continuously) is the only way to catch a setup that silently regressed.