01Three records, one question
A receiving server asks of every message: did this really come from the domain it names? Three records answer it together. SPF lists the servers allowed to send for the domain. DKIM puts a signature on each message that only the real sender’s key can make. DMARC ties the two to the From line a reader actually sees — a message passes only if SPF or DKIM passes for that same domain — and tells the receiver what to do when neither does.
None of the three is enough alone. SPF checks an address the reader never sees and breaks when mail is forwarded; DKIM proves a signature but not whose; only DMARC turns them into a rule. That is why DMARC carries the most points here, and why a domain without an enforcing DMARC policy cannot grade above C.
02SPF, and the limit of ten
An SPF record is one TXT record at the domain itself, beginning
v=spf1: a list of mechanisms — ip4: and ip6: for
addresses, include: for another domain’s list, mx and
a for this domain’s own servers — and a final all that
says what happens to everyone else: -all fail, ~all soft
fail, ?all no opinion, +all welcome, which is never right.
Two rules catch most domains out. There may be only one SPF
record; two is a permanent error and SPF fails for every message. And evaluating
it may take at most ten DNS lookups (RFC 7208 §4.6.4), counting
every include, a, mx, ptr,
exists and redirect — including the ones inside the
includes. Each service you add brings its own lookups, and the eleventh breaks
the record for everyone. This page follows every include and counts.
03DMARC, from none to reject
A TXT record at _dmarc. the domain. Its policy, p=, is
the whole point: none asks for reports and changes nothing;
quarantine sends failing mail to spam; reject refuses it.
rua= names where the daily aggregate reports go — an XML summary, from
every large receiver, of every server that sent mail claiming to be you, and
whether it passed.
The safe way up is the order the prescription gives. Publish with
p=none and a report address; read two weeks of reports; make sure
every service that sends as you passes SPF or DKIM; then quarantine;
then, when nothing legitimate is failing, reject. The prescription
writes the quarantine record directly, with the monitoring step beside it for
anyone not certain their senders are covered.
04DKIM, and why it cannot be guessed
A DKIM key lives at <selector>._domainkey. the domain, and the
selector can be any name at all — each message says which one signed it. There is
no way to list a domain’s selectors from outside, so this page tries more than
thirty that mail providers use by default. Finding none is reported as
not found, not as proof there is none.
Nor can a DKIM record be written here: the key pair is made by whoever sends your mail, which keeps the private half to sign with. The prescription says where, at your provider, to switch it on. Keys should be 2048-bit RSA or Ed25519; 1024-bit still verifies but is past its time (RFC 8301).
05MTA-STS and TLS-RPT: mail on its way in
Mail between servers is encrypted only if both sides agree to it, and an attacker
in the path can make it look as though your server does not — so the sender
delivers in plain text. MTA-STS (RFC 8461) closes that: a TXT
record at _mta-sts. announces a policy file, served over HTTPS at
mta-sts. the domain, that names your mail servers and says “always
encrypt, and only to these”.
TLS-RPT (RFC 8460) is its companion: a TXT record at
_smtp._tls. asking senders to report, daily, every connection that
failed. Publish both, run the policy in testing mode while the reports
come in, and switch to enforce once they are clean. The policy must
list every MX host — the page checks each one against it, because a host the
policy does not match is a host enforcing senders will refuse.
06BIMI and DNSSEC
BIMI puts your logo beside your messages in Gmail, Apple Mail and Yahoo. It is honoured only once DMARC enforces, needs a logo in the SVG Tiny PS format and — for Gmail and Apple — a paid mark certificate, so it is worth five points here and no record is written for it.
DNSSEC signs the answers about your domain, so a forged MX or SPF record can be told from the real one. It is switched on at your DNS host and completed with a DS record at your registrar, not with a record you paste in.
07How the grade is worked out
Nobody grades email security officially; a receiver never sees a letter, only the records. The grade is this page’s way of saying how far along a domain is, by a rule printed in full here and in every report:
| Check | Points | The rule |
|---|---|---|
| SPF | 25 | -all or ~all within ten lookups: 25 · no “all”: 12 · ?all: 8 · over ten lookups or two void lookups: 5 · +all, none, two records or invalid: 0 · “ptr” costs 3 |
| DMARC | 30 | reject: 30 · quarantine: 28 · none: 10 · enforcement scaled by pct · no report address: −3 · sp=none under an enforcing policy: −2 |
| DKIM | 20 | a key of 2048 bits or more, or Ed25519: 20 · 1024 bits: 14 · smaller: 5 · none found: 0 |
| MTA-STS | 10 | enforce, every MX covered: 10 · testing: 8 · policy unreadable or an MX not covered: 2 |
| TLS-RPT | 5 | a valid record with a report address |
| DNSSEC | 5 | the zone is signed |
| BIMI | 5 | a valid record, with DMARC enforcing |
A at 85 or more, B at 70, C at 55, D at 40, F below — the same letters the WHOIS report and our server use. A domain whose DMARC policy
does not enforce is held at C whatever else it has; one whose SPF ends
+all is held at D. A domain that takes and sends no mail is graded
on a shorter list — SPF -all (30), DMARC reject (35), a null MX (20),
DNSSEC (15) — because its only job is to refuse forgeries. Checks that do not apply
are left out of the total rather than given away, and a grade is withheld
altogether when SPF or DMARC could not be read.
08How this doctor works
- Your input is reduced to a domain: an email address, a link or a subdomain around it is dropped.
- Our server reads the MX, SPF, DMARC, TLS-RPT, BIMI, MTA-STS and CAA records and the DS record, follows every SPF include and redirect to the end, counting lookups and void lookups, and asks for DKIM keys under more than thirty common selectors at once.
- If an MTA-STS record exists, the policy file is fetched over HTTPS from the domain’s own mta-sts host — no further than 64 KB, no longer than six seconds.
- This page reads every record against its standard’s grammar, grades it by the rubric above, and explains each finding.
- Where a record is missing or wrong, it writes the replacement, checks it against the same grammar, and shows it only if it passes — with the host, the type, the value and a zone-file line.
One thing is not tested: whether your mail servers actually offer encryption. That needs a connection to port 25, which our server’s host blocks, and the page says so rather than guessing. Readings are kept on our server for ten minutes; nothing you examine is stored anywhere else.