ONLINE TOOL · FREE ACCOUNT REQUIRED

Review domain and email security.

Turn technical DNS and email settings into findings you can act on.

Understand your domain's mail configuration.

Enter a domain and optionally up to five known DKIM selectors. Review DNS, MX, SPF, DKIM, DMARC, BIMI, MTA-STS, TLS-RPT, DNSSEC evidence and the public HTTPS certificate.

Optional settings are explained separately.

A missing optional policy is marked not configured. Without supplied DKIM selectors, only default is checked; absence there does not prove that DKIM is missing. This is an on-demand configuration audit, not continuous monitoring or a mail-delivery guarantee.

ILLUSTRATIVE EXAMPLE · SYNTHETIC DATA

See what a result looks like.

This fixed example explains the response format. It is not a live check of a company, invoice or domain.

SPF: Review the soft-fail policy; identify legitimate senders before making it stricter.
DKIM: Not tested conclusively: no key at the default selector. Supply known selectors to check them.
Optional policies: BIMI, MTA-STS and TLS-RPT are not configured in this example.
Certificate: Hostname and trust check passed; 60 days remaining at the example's check time.

Read the status and recommendation for each check. Optional settings, inconclusive evidence and confirmed failures have different meanings.

View the example JSON response

{
  "domain": "example.com",
  "checkedAt": "2026-09-16T12:00:00+00:00",
  "status": "warning",
  "checks": [
    {
      "check": "dns",
      "status": "pass",
      "code": "domain_resolves",
      "detail": null,
      "records": null,
      "evidenceLimited": false,
      "summary": "The domain has a published IPv4 or IPv6 address.",
      "recommendation": null,
      "optional": false
    },
    {
      "check": "mx",
      "status": "pass",
      "code": "mx_published",
      "detail": null,
      "records": null,
      "evidenceLimited": false,
      "summary": "Incoming mail servers are published in DNS.",
      "recommendation": null,
      "optional": false
    },
    {
      "check": "spf",
      "status": "warning",
      "code": "softfail_policy",
      "detail": "Configuration analysis only; no sender IP, HELO or MAIL FROM was evaluated.",
      "records": [
        "example.com TXT v=spf1 mx ~all"
      ],
      "evidenceLimited": false,
      "summary": "SPF is published with ~all (soft fail). Unlisted senders are treated as suspicious, rather than given an SPF hard fail.",
      "recommendation": "Confirm every legitimate sender is authorized before considering -all. Do not change this solely to make the report green.",
      "optional": false
    },
    {
      "check": "dmarc",
      "status": "pass",
      "code": "direct_policy_quarantine",
      "detail": null,
      "records": null,
      "evidenceLimited": false,
      "summary": "DMARC requests quarantine for messages that fail aligned SPF and DKIM.",
      "recommendation": null,
      "optional": false
    },
    {
      "check": "dkim",
      "status": "not_tested",
      "code": "selector_required",
      "detail": null,
      "records": null,
      "evidenceLimited": false,
      "summary": "No DKIM key was found at the default selector. A different selector may be in use.",
      "recommendation": "Enter the selector supplied by your mail provider, or the s= value from a DKIM-Signature header. The d= domain in that header must match the domain you check.",
      "optional": false
    },
    {
      "check": "bimi",
      "status": "not_configured",
      "code": "record_not_found",
      "detail": null,
      "records": null,
      "evidenceLimited": false,
      "summary": "No BIMI record is published. BIMI is an optional inbox-logo feature.",
      "recommendation": "Configure this only if you want supported mailboxes to display a verified brand logo. It is not required for ordinary email.",
      "optional": true
    },
    {
      "check": "mta_sts",
      "status": "not_configured",
      "code": "record_not_found",
      "detail": null,
      "records": null,
      "evidenceLimited": false,
      "summary": "No MTA-STS record is published. This optional policy can strengthen encrypted mail delivery.",
      "recommendation": "An MTA-STS rollout needs a valid HTTPS policy and verified MX coverage. Start with testing before enforcing delivery requirements.",
      "optional": true
    },
    {
      "check": "tls_rpt",
      "status": "not_configured",
      "code": "record_not_found",
      "detail": null,
      "records": null,
      "evidenceLimited": false,
      "summary": "No TLS reporting record is published. This optional feature reports mail encryption problems.",
      "recommendation": "Publish TLS reporting only after choosing and preparing the report destination.",
      "optional": true
    },
    {
      "check": "dnssec",
      "status": "unknown",
      "code": "no_authenticated_answer",
      "detail": null,
      "records": null,
      "evidenceLimited": false,
      "summary": "DNSSEC validation could not be established for this answer.",
      "recommendation": "Try a new check later; this result does not by itself justify changing DNS.",
      "optional": false
    },
    {
      "check": "certificate",
      "status": "pass",
      "code": "hostname_and_chain_valid",
      "detail": null,
      "records": null,
      "evidenceLimited": false,
      "summary": "The HTTPS certificate matches the hostname and has a trusted certificate chain.",
      "recommendation": null,
      "optional": false
    }
  ],
  "certificate": {
    "status": "pass",
    "expiresAt": "2026-11-15T12:00:00+00:00",
    "daysRemaining": 60,
    "reason": null,
    "revocation": "not_checked"
  },
  "resolver": "Cloudflare DNS over HTTPS",
  "version": "2026-09-2"
}

Download synthetic JSON example · Run your own check →

Start with 10 free checks each month.

At most 2 per day, no card and no expiry. Email verification and an authenticator protect your account. Monthly website subscriptions provide more checks; paid purchases are available to VAT-registered EU businesses.

Completed conclusive checks use one unit, including negative results. Technical failures and inconclusive checks use none. Results are encrypted for replay for up to 24 hours; metadata is retained up to 90 days.

View website prices · Integrate this API · All online tools