What it does
You give it a domain. It reads what that domain publishes in public DNS - right then, live - and runs thirteen checks across three groups: does the domain work at all, is its mail authenticated, and is it hardened beyond the basics.
Each check comes back with a verdict, a finding in words, and where there is something to do, the thing to do. It ends with a weighted score out of 100.
Why it matters
Almost every domain that has a problem here looks fine from the inside. Your own mail arrives normally whether or not anyone else can forge your domain, so nothing tells you. The check is the cheapest possible way to find out - it costs nothing, takes seconds, and needs no access to anything.
How to use it
- Type the domain -
yourcompany.com, not an email address and not a full web address. If you paste one of those, the domain is taken out of it. - Press Check domain and wait a few seconds. It is doing real DNS lookups, including following your whole SPF include chain.
- Read the failures first, starting with the authentication group.
- Make one change, wait a few minutes for DNS caches to expire, and re-run it.
The three sample buttons check real domains live, exactly as yours is checked. They exist so a first-time reader can see what a good result, a mixed result and a bad result look like before running their own.
Reading the score
Checks are weighted. SPF, DKIM, the DMARC record and its reporting address carry the most; the DNS group and the hardening group carry the least. Fixing one authentication failure moves the number far more than fixing three hardening ones - which is the correct order to work in anyway.
Anything marked not applicable is left out of the score entirely. A parked domain with no MX record is configured correctly, and inflating a score by calling a correct configuration a problem would make the number worthless.
If you sign up afterwards
A check run without an account is remembered for that browser using a first-party cookie holding an anonymous identifier - not your identity, not an email address, and no advertising or tracking of any kind. It exists so a result can be handed back to you.
If you create an account in the same browser, that history is claimed onto the new account and the verification screen tells you how many results moved across. If you never sign up, the identifier expires on its own.
What it does not do
The honest limits
It reads, it never writes. The check makes no change to your DNS, sends no mail, opens no connection to your mail servers and reads no mailbox.
It is a snapshot, not monitoring. It tells you what is published now. It cannot tell you who has been sending mail as you - only DMARC reports gathered over time can, and collecting those for you is on the roadmap rather than built.
It cannot prove a negative about DKIM. DKIM selector names cannot be listed from DNS, so a "no key found" result means the selectors we know to try were empty - see DKIM selectors.
It sees only public DNS. What your internal resolvers answer is irrelevant to a receiving mail server, so it is irrelevant here too.