Email & DNS Audit
See your domain's email security records (SPF, DKIM, DMARC) on one screen, no sign-up needed.
This tool scans your domain's DNS records and checks five components involved in email delivery. The MX record shows which server receives your mail. SPF lists, in a TXT record, which servers are authorised to send email on behalf of your domain. DKIM signs every outgoing message with a private key, and the receiving server verifies that signature. DMARC tells receivers what to do when SPF or DKIM fails: do nothing, quarantine, or reject.
BIMI lets your brand logo appear in the inbox, but only once DMARC enforcement is set to quarantine or reject. MTA-STS is a policy record that forces messages to travel over an encrypted (TLS) connection. If any one of these five records is missing or misconfigured, receiving servers may treat your mail as suspicious, push it to spam, or reject it outright.
The result is a snapshot of whatever records are currently published in DNS; if you've just made a change, it may not show the new state until propagation finishes, which can take anywhere from minutes to hours depending on the record's TTL. Simply having a record isn't enough, it needs the right syntax and the right scope.
How to use it
- Enter your domain (example.com), not www or an email address.
- Start the audit and wait for all five records to be scanned.
- Find whichever record is flagged as missing or incorrect.
- Add or fix that record in your DNS provider's panel.
- Re-run the audit a few hours later to confirm it has propagated.
FAQ
Do I need both SPF and DKIM?
Yes, they work at different layers. SPF verifies the sending server, DKIM verifies the message wasn't altered, and both are needed for DMARC to work reliably.
What happens without a DMARC record?
Receiving servers have no rule to follow when SPF or DKIM fails, which makes your mail more likely to land inconsistently in spam or be spoofed by others.
Is setting up BIMI mandatory?
No, BIMI is optional and only works once your DMARC policy enforces quarantine or reject; getting SPF, DKIM and DMARC right comes first.
Does the result update instantly after a fix?
No, DNS changes can take anywhere from minutes to hours to propagate depending on the record's TTL, so it's worth re-checking a few hours later.
