Tools
Is your domain
set up to be trusted?
SPF, DKIM, DMARC, BIMI and MX, read from live DNS. You get the records as published and what each one actually says, not a score and a sales call.
What each record does
- MX
- Where mail addressed to the domain is delivered. Without it nothing arrives at all, whatever else is configured.
- SPF
- A published list of the servers allowed to send as the domain. Its hidden failure is the ten-lookup limit: go past it and SPF stops working entirely, while the record still looks correct.
- DKIM
- A signature on each outgoing message, checked against a public key in DNS. It survives forwarding, which is the one thing SPF cannot do.
- DMARC
- The instruction that ties the other two together: what a receiver should do when a message fails. Without it, a receiver that catches a forgery has nothing from you telling it to act, and usually delivers it.
- BIMI
- Your logo beside your mail in supporting clients. It is a reward for having DMARC enforced, not a substitute for it, and most receivers want a Verified Mark Certificate too.
Nothing is stored. Each check is a set of public DNS queries made when you press the button, and the answers are the same ones any receiving mail server would get.
Questions this raises
What is a good DMARC policy?
p=reject is the destination: it tells receivers to refuse mail that fails authentication. p=quarantine is the sensible step before it. p=none is monitoring only. It explicitly asks receivers to change nothing, so forgeries still land in inboxes. Start at none with a rua address collecting reports, read them for a few weeks, then move up.
How many DNS lookups can an SPF record have?
Ten, and that includes every lookup made inside the records you include. Past ten, SPF returns a permanent error and receivers treat your mail as unauthenticated, while the record on screen still looks perfectly correct. This is the most common way a working SPF record quietly stops working, which is why the checker follows your includes rather than counting the first line.
Why could you not find my DKIM record?
DKIM keys are addressed by a selector, and a domain never publishes a list of the ones it uses. The checker tries the selectors your mail provider is known to use plus a common set. Finding one proves DKIM is set up; finding none proves nothing. If your provider gave you a selector, look up that name followed by ._domainkey and your domain directly.
What happens if I have two SPF records?
Both are thrown away. RFC 7208 makes more than one SPF record a permanent error, so instead of two sets of authorised servers you get none. Merge them into a single record: the includes from both, one v=spf1 at the front, one all mechanism at the end.
Do I need BIMI?
No. BIMI puts your logo beside your mail in supporting clients, which is worth having and changes nothing about whether mail is delivered. It also does nothing at all until DMARC is enforcing, and most large receivers want a Verified Mark Certificate as well, so it is the last thing to do, never the first.
