Guides
How we check a domain
Every check is a set of DNS lookups and one HTTPS fetch, run from our own infrastructure. Nothing is sent to your domain or your users.
What we look up
| Component | Lookups | Weight in score |
|---|---|---|
| SPF | TXT at the apex, then every include and redirect (lookup counting, void lookups) | 25% |
| DKIM | TXT (following CNAME delegation) at 68 provider-default and common selectors plus any you add or we learn from DMARC reports; key type, size and fingerprint; RFC 6376, 8301 and 8463 rules | 25% |
| DMARC | TXT at _dmarc; every tag validated | 30% |
| MX | MX records and their A/AAAA; provider identified from hostnames | 5% |
| MTA-STS | TXT at _mta-sts and the policy file at https://mta-sts.domain/.well-known/mta-sts.txt | 5% |
| TLS-RPT | TXT at _smtp._tls | 2% |
| Reverse DNS | PTR for the sending IP (or first MX) and forward confirmation | 3% |
| Blacklists | Spamhaus ZEN, SpamCop, Barracuda, PSBL, UCEPROTECT L1 for the domain A records, MX IPs and your sending IP | 5% |
| BIMI | TXT at default._bimi; informational, no weight | 0% |
Each component starts at 100 and loses points per finding (critical 60, high 30, medium 15, low 5). Cross-protocol problems, such as DMARC enforcement without DKIM, subtract from the total. Grades: A 90+, B 80+, C 70+, D 60+, F below.
What we do not do
- We never send test messages to your domain or to any address you check.
- We never modify DNS. Fixes are values for you to paste.
- We do not accept forensic (ruf) DMARC reports.
- Public tool results are cached ten minutes and not tied to a person.
Run the check on your domain.
Free, no account.
No card for the free plan · Billing by Stripe · We never send mail on your behalf · Privacy