πŸ§ͺ Run this tool

βš™οΈ Advanced options

Advanced controls are available for this tool and still bounded for abuse protection.

πŸ“˜ Excessive Explanation

🧩 Technical Details

What this tool checks

  • Presence and parse quality of SPF, DMARC, and DKIM selector records.
  • Policy coherence indicators for enforcement and reporting flow.
  • Output quality suitable for deliverability and security handoff.

How to read the output

  • Result Summary indicates baseline sender-auth readiness.
  • Overview shows which control is present, missing, or weak.
  • Technical Details helps verify selector tags and policy syntax.
  • Raw Output can be used in change review and audit trails.

Common failure patterns

  1. SPF missing or overly permissive includes weaken spoofing defense.
  2. DMARC policy absent or too relaxed for current threat model.
  3. DKIM selector mismatch between MTA and DNS publication.
  4. Policy drift after mail-provider migration or key rotation.

Remediation workflow

  1. Publish accurate SPF scope for real outbound infrastructure.
  2. Add DMARC at _dmarc domain and stage toward stricter enforcement.
  3. Validate active DKIM selectors and rotate keys safely.
  4. Re-run checks after propagation and review pass/alignment metrics.

Next steps

❓ Frequently asked questions

Why does this page test multiple auth controls together?

Deliverability and anti-spoofing strength depend on SPF, DKIM, and DMARC working as a combined policy set.

Is SPF alone enough to prevent spoofing?

No. DMARC enforcement and DKIM alignment are critical for stronger protection.

Should DMARC start in reject mode immediately?

Usually start with monitoring to validate alignment before strict enforcement.

How often should DKIM keys be reviewed?

Regularly, and always during provider migration or security maintenance windows.

Can auth posture be healthy while delivery still fails?

Yes. Reputation, content, and transport conditions can still affect final placement.