Who may send as you.
And the records that say so.

01Three records, one question

A receiving server asks of every message: did this really come from the domain it names? Three records answer it together. SPF lists the servers allowed to send for the domain. DKIM puts a signature on each message that only the real sender’s key can make. DMARC ties the two to the From line a reader actually sees — a message passes only if SPF or DKIM passes for that same domain — and tells the receiver what to do when neither does.

None of the three is enough alone. SPF checks an address the reader never sees and breaks when mail is forwarded; DKIM proves a signature but not whose; only DMARC turns them into a rule. That is why DMARC carries the most points here, and why a domain without an enforcing DMARC policy cannot grade above C.

02SPF, and the limit of ten

An SPF record is one TXT record at the domain itself, beginning v=spf1: a list of mechanisms — ip4: and ip6: for addresses, include: for another domain’s list, mx and a for this domain’s own servers — and a final all that says what happens to everyone else: -all fail, ~all soft fail, ?all no opinion, +all welcome, which is never right.

Two rules catch most domains out. There may be only one SPF record; two is a permanent error and SPF fails for every message. And evaluating it may take at most ten DNS lookups (RFC 7208 §4.6.4), counting every include, a, mx, ptr, exists and redirect — including the ones inside the includes. Each service you add brings its own lookups, and the eleventh breaks the record for everyone. This page follows every include and counts.

The SPF checker does the same count in your browser for any name, subdomains included, and shows the lookups in the order a receiver meets them.

03DMARC, from none to reject

A TXT record at _dmarc. the domain. Its policy, p=, is the whole point: none asks for reports and changes nothing; quarantine sends failing mail to spam; reject refuses it. rua= names where the daily aggregate reports go — an XML summary, from every large receiver, of every server that sent mail claiming to be you, and whether it passed.

The safe way up is the order the prescription gives. Publish with p=none and a report address; read two weeks of reports; make sure every service that sends as you passes SPF or DKIM; then quarantine; then, when nothing legitimate is failing, reject. The prescription writes the quarantine record directly, with the monitoring step beside it for anyone not certain their senders are covered.

Since May 2026 DMARC is RFC 9989, which replaced RFC 7489, and this doctor reads it so: pct= is historic and no longer scales the grade, t=y marks a policy under test that receivers apply one level lower, and a record with no valid policy but a report address is read as p=none. The DMARC checker reads any record tag by tag, with DMARC record examples and the DNS tree walk that finds the record a subdomain falls under.

04DKIM, and why it cannot be guessed

A DKIM key lives at <selector>._domainkey. the domain, and the selector can be any name at all — each message says which one signed it. There is no way to list a domain’s selectors from outside, so this page tries more than thirty that mail providers use by default. Finding none is reported as not found, not as proof there is none.

Nor can a DKIM record be written here: the key pair is made by whoever sends your mail, which keeps the private half to sign with. The prescription says where, at your provider, to switch it on. Keys should be 2048-bit RSA or Ed25519; 1024-bit still verifies but is past its time (RFC 8301).

If you know the selector — the s= tag of a message’s DKIM-Signature — the DKIM lookup finds that one key and measures its length.

05MTA-STS and TLS-RPT: mail on its way in

Mail between servers is encrypted only if both sides agree to it, and an attacker in the path can make it look as though your server does not — so the sender delivers in plain text. MTA-STS (RFC 8461) closes that: a TXT record at _mta-sts. announces a policy file, served over HTTPS at mta-sts. the domain, that names your mail servers and says “always encrypt, and only to these”.

TLS-RPT (RFC 8460) is its companion: a TXT record at _smtp._tls. asking senders to report, daily, every connection that failed. Publish both, run the policy in testing mode while the reports come in, and switch to enforce once they are clean. The policy must list every MX host — the page checks each one against it, because a host the policy does not match is a host enforcing senders will refuse.

The MTA-STS and TLS-RPT check reads both records from two resolvers in your browser, and the MX lookup lists the mail hosts in the order senders try them, with their addresses.

06BIMI and DNSSEC

BIMI puts your logo beside your messages in Gmail, Apple Mail and Yahoo. It is honoured only once DMARC enforces, needs a logo in the SVG Tiny PS format and — for Gmail and Apple — a paid mark certificate, so it is worth five points here and no record is written for it.

DNSSEC signs the answers about your domain, so a forged MX or SPF record can be told from the real one. It is switched on at your DNS host and completed with a DS record at your registrar, not with a record you paste in.

The BIMI record check reads the logo record and says which of the draft’s DMARC conditions, if any, stands in the way.

07How the grade is worked out

Nobody grades email security officially; a receiver never sees a letter, only the records. The grade is this page’s way of saying how far along a domain is, by a rule printed in full here and in every report:

A at 85 or more, B at 70, C at 55, D at 40, F below — the same letters the WHOIS report and our server use. A domain whose DMARC policy does not enforce is held at C whatever else it has; one whose SPF ends +all is held at D. A domain that takes and sends no mail is graded on a shorter list — SPF -all (30), DMARC reject (35), a null MX (20), DNSSEC (15) — because its only job is to refuse forgeries. Checks that do not apply are left out of the total rather than given away, and a grade is withheld altogether when SPF or DMARC could not be read.

08How this doctor works

1. Your input is reduced to a domain: an email address, a link or a subdomain around it is dropped. To read the exact name you typed, subdomains included, switch to Read in my browser.
2. Our server reads the MX, SPF, DMARC, TLS-RPT, BIMI, MTA-STS and CAA records and the DS record, follows every SPF include and redirect to the end, counting lookups and void lookups, and asks for DKIM keys under more than thirty common selectors at once.
3. If an MTA-STS record exists, the policy file is fetched over HTTPS from the domain’s own mta-sts host — no further than 64 KB, no longer than six seconds.
4. This page reads every record against its standard’s grammar — DMARC against RFC 9989, which replaced RFC 7489 in May 2026 — grades it by the rubric above, and explains each finding.
5. Where a record is missing or wrong, it writes the replacement, checks it against the same grammar, and shows it only if it passes — with the host, the type, the value and a zone-file line.

One thing is not tested: whether your mail servers actually offer encryption. That needs a connection to port 25, which our server’s host blocks, and the page says so rather than guessing. Readings are kept on our server for ten minutes; nothing you examine is stored anywhere else.