Email security checker (SPF, DKIM, DMARC)

Check a domain's SPF, DKIM, DMARC, MTA-STS and TLS-RPT records and see who can spoof it.

What this checks

Email has no built-in sender check, so anyone can put your domain in the From line. Three DNS records fix that, and receivers like Gmail and Outlook now require them from bulk senders:

SPF lists the servers allowed to send as your domain. It must be a single record and stay under 10 DNS lookups, or it fails everywhere.
DKIM signs each message with a key published in DNS. Use 2048-bit RSA or Ed25519.
DMARC tells receivers what to do when SPF and DKIM fail: none (monitor), quarantine (spam) or reject, and where to send reports.
MTA-STS and TLS-RPT protect mail coming to you from TLS downgrade attacks.

A good starting setup

example.com.         TXT "v=spf1 include:_spf.your-provider.com -all"
_dmarc.example.com.  TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"
# DKIM: publish the key your mail provider gives you, e.g.
selector1._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=MIIBIjANBg…"

All lookups go through public DNS-over-HTTPS resolvers. Nothing you enter is stored.