SPF · DKIM · DMARC · MTA-STS · DNSBL

Are your emails safe?

Evaluate your SPF, DKIM and DMARC records, MX servers and reputation in a single run; see missing configuration as a score and an itemised list.

 

Leave empty to scan 18 common selectors automatically.

Examples:

Analysis result

Enter a domain above to see the analysis.

E-posta

Why is an email security test needed?

If you send email from your domain, your messages must be verifiable. SPF (RFC 7208) defines which servers may send on your behalf, DKIM cryptographically signs each message, and DMARC (RFC 7489) tells the receiving server what to do when either check fails.

NetQuery queries these records over DNS over HTTPS in parallel; it parses SPF mechanisms, counts DNS lookups in the include chain, scans DKIM selectors and measures key length, and interprets your DMARC policy (none / quarantine / reject). It also resolves your MX server IP addresses and checks them against blacklists.

You get a weighted score out of 100 and a letter grade from A to F. Failed or incomplete configuration is listed item by item, so you can see exactly which steps will prevent domain spoofing and keep your mail out of the spam folder.

FAQ

Frequently asked questions

What is the difference between SPF, DKIM and DMARC?
SPF lists the servers authorised to send email on behalf of your domain and verifies the sending IP address. DKIM verifies a cryptographic signature to prove the message was not altered in transit. DMARC combines both and tells the receiving server whether to reject, quarantine or accept a message when the checks fail. Used together they largely prevent domain spoofing.
Why should my DMARC policy not be "none"?
A p=none policy blocks nothing; it only produces reports. Attackers keep sending email while impersonating your domain. After validating your records, moving to p=quarantine and then to p=reject is critical to protecting your domain identity.
What is a DKIM selector and how do I find it?
A DKIM selector is the name of the DNS record that publishes your public key (e.g. google._domainkey.example.com). Different systems (Google Workspace, Microsoft 365, Mailchimp, etc.) use different selectors. NetQuery scans 18 common selectors automatically; if you use another provider you can enter the selector name manually.