Email security checker

Type a domain to see the DNS records that protect its email: MX, SPF, DMARC, MTA-STS, TLS-RPT and BIMI, plus DKIM if you add a selector. Each record is shown, explained in plain words and marked pass or needs work.

Only the domain name is sent. It goes to a public DNS resolver (Cloudflare, or Google if Cloudflare does not answer) to look up public records. Nothing is sent to Secria and nothing is stored.

How do I find a DKIM selector?
From an email
Open any email sent from the domain and view its headers. Find the line that starts with DKIM-Signature and read the value after s=. That is the selector.
Google Workspace
The selector is google unless the admin chose another name.
Microsoft 365
The selectors are selector1 and selector2.
Other services
Newsletter and billing tools sign with their own selectors, so one domain often has several. Check each one you find.
On this page

What an email security check looks at

An email security check reads the public DNS records a domain uses to prove its mail is genuine and to ask for encrypted delivery. Three of them, SPF, DKIM and DMARC, let a receiving server tell real mail from forged mail. Two more, MTA-STS and TLS-RPT, cover the connection that brings mail in. The checker reads each record the way a mail server would and reports what it says.

A pass means the record is there, is valid and states a policy. It does not test your mail servers or any message, so treat the results as a review of your DNS setup.

What each record does

MX

MX records name the servers that receive mail for a domain. The number in front is a priority, and senders try the lowest number first. A domain that never receives mail can say so with a single record of 0 ., called a null MX.7

SPF

SPF is one TXT record on the domain that starts with v=spf1 and lists the servers allowed to send its mail. The last term says what to do with everyone else: -all means fail them, ~all means treat them as doubtful, ?all says nothing either way, and +all allows everyone. A domain must have exactly one SPF record, and reading it may take no more than 10 DNS lookups.1

DKIM

With DKIM, the sending server signs each message and publishes the matching public key in DNS under a selector name. The receiver fetches the key and checks that the signed parts of the message have not changed since it was sent. Keys shorter than 1024 bits must not be accepted, and signers are told to use at least 2048 bits. A record with an empty p= tag means the key was revoked.23

DMARC

DMARC is a TXT record at _dmarc under the domain. It passes when SPF or DKIM passes for the same domain shown in the From line. The p tag says what the owner wants done with mail that fails: none (deliver as usual), quarantine (treat as suspicious) or reject. The sp tag sets a separate policy for subdomains, rua asks for daily summary reports, and adkim and aspf choose strict or relaxed matching.

DMARC is now defined by RFC 9989, which replaced RFC 7489 in May 2026. It retired the pct tag, added a test mode tag (t=y) and added np, a policy for subdomains that do not exist.4

MTA-STS

MTA-STS lets a domain tell sending servers to deliver only over an encrypted connection to a server with a valid certificate. It has two parts: a TXT record at _mta-sts with a version and an id, and a policy file served over HTTPS that lists the mail servers and a mode of enforce, testing or none. This tool checks the TXT record only. Browsers are blocked from reading the policy file on most domains, so the policy mode is not checked.5

TLS-RPT

TLS-RPT is a TXT record at _smtp._tls that gives an address for reports. Sending servers use it to tell the owner when an encrypted delivery failed, for example because a certificate expired.6

BIMI

BIMI is optional. It points to a brand logo that some inboxes show next to messages that pass DMARC. It adds no protection of its own, so a missing BIMI record is not counted against a domain.

How to fix common results

No SPF record, or more than one

Add one TXT record on the domain that lists every service that sends your mail and ends in ~all or -all. If the checker finds two records, merge them into one. Two SPF records count as an error, and SPF then fails for all mail.

SPF needs more than 10 lookups

Each include adds its own lookups, so the count grows quickly as you add services. Remove includes for services you no longer use. If you are still over, replace an include with the IP ranges it stands for, or move some senders to a subdomain with its own SPF record.

SPF ends in +all or ?all

Change the last term to ~all while you confirm that every sender is listed, then to -all if you want unlisted servers to fail outright.

No DMARC record

Add a TXT record at _dmarc under your domain, such as v=DMARC1; p=none; rua=mailto:reports@yourdomain. This changes nothing about delivery. It starts the reports that show who is sending as you.

DMARC policy is none

Read the reports until every real sender passes SPF or DKIM with your own domain. Then change the policy to quarantine, and later to reject. Gmail asks anyone who sends it more than 5,000 messages a day to publish a DMARC record, and a policy of none meets that rule, but it does not ask receivers to stop forged mail.8

DKIM key not found, weak or revoked

Not found usually means the selector name is wrong, so check it against a real email. If the key is 1024 bits, create a 2048-bit key in your mail service, publish it under a new selector and switch signing to it. If the record has an empty key, that selector was retired and mail should be signed with another one.

No MTA-STS or TLS-RPT record

Publish the policy file at https://mta-sts.yourdomain/.well-known/mta-sts.txt in testing mode, add the two TXT records, and read the reports. When they show no failures, change the mode to enforce and give the TXT record a new id.

Use your own domain with Secria Mail

Secria publishes an SPF record that ends in -all, a DMARC policy of reject and an MTA-STS policy in enforce mode for secria.me. Press Try secria.me above to see the records. Mail Plus and Secria Pro let you connect your own domains.

Questions about email security checks

How do I check if a domain has SPF, DKIM and DMARC?

Type the domain into the checker above and press Check domain. It looks up the SPF record on the domain itself, the DMARC record at _dmarc.yourdomain, and, if you add a selector, the DKIM key at selector._domainkey.yourdomain. All three are public DNS records, so you can check any domain, not only your own.

What is the difference between SPF, DKIM and DMARC?

SPF is a list of the servers allowed to send mail for a domain. DKIM is a signature on each message that receivers check against a public key in the domain’s DNS. DMARC ties the two to the address people see in the From line and tells receivers what to do when both fail: nothing, send to spam, or reject.

Can I check DKIM without a selector?

No. A DKIM key is stored under a name the sender picks, called a selector, and DNS has no way to list every name under a domain. To find a selector, open an email sent from the domain, view its headers and look for s= in the DKIM-Signature line. Google Workspace uses google unless the admin changed it, and Microsoft 365 uses selector1 and selector2.

What does “too many DNS lookups” mean for SPF?

A receiver may make at most 10 DNS lookups while it reads an SPF record. Each include, a, mx, ptr, exists and redirect costs one, and so does each one inside an included record. Past 10 the receiver stops with a permanent error, and SPF fails for every message. The fix is to remove services you no longer send through, or to replace an include with the ip4 and ip6 ranges it stands for.

What is a good DMARC policy?

Start with p=none and a rua address, and read the reports for a few weeks to find every service that sends mail as your domain. Fix SPF and DKIM for each one. Then move to p=quarantine, and to p=reject once the reports are clean. A domain that stays on p=none gets reports but does not ask receivers to stop forged mail.

Do I need MTA-STS and TLS-RPT?

They protect mail coming in to your domain. Without MTA-STS, a sending server that cannot set up an encrypted connection may fall back to delivering in plain text, and it does not check that it reached the right server. MTA-STS tells senders to deliver only over verified TLS. TLS-RPT asks them to send you a report when that fails, so you hear about problems.

What is sent when I check a domain?

Only the domain name, and the selector if you add one. Your browser sends them as DNS questions to Cloudflare’s public DNS resolver, or to Google’s if Cloudflare does not answer, the same kind of lookup any mail server makes. Nothing is sent to Secria and nothing is stored.

SPFThe DNS record that lists which servers may send email for a domain. DKIMA digital signature on every email that shows which domain sent it. DMARCThe policy that tells receivers what to do with email that fails SPF and DKIM. MTA-STSA policy that makes other mail servers deliver to a domain only over secure TLS. Email header analyzerFree tool: paste an email’s headers to see its route and its SPF, DKIM and DMARC results. Custom domain emailUse your own domain with Secria Mail, with the DNS records checked for you.

Sources

  1. IETF, RFC 7208: Sender Policy Framework (SPF) for Authorizing Use of Domains in Email, Version 1, sections 3.2 and 4.6.4 (April 2014).
  2. IETF, RFC 6376: DomainKeys Identified Mail (DKIM) Signatures, section 3.6.1 (September 2011).
  3. IETF, RFC 8301: Cryptographic Algorithm and Key Usage Update to DomainKeys Identified Mail (DKIM), section 3.2 (January 2018).
  4. IETF, RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC), which obsoletes RFC 7489 (May 2026).
  5. IETF, RFC 8461: SMTP MTA Strict Transport Security (MTA-STS) (September 2018).
  6. IETF, RFC 8460: SMTP TLS Reporting (September 2018).
  7. IETF, RFC 7505: A “Null MX” No Service Resource Record for Domains That Accept No Mail (June 2015).
  8. Google, Email sender guidelines.

Private email on your own domain.

Secria Mail is free to start. Add your own domain with Mail Plus or Secria Pro.

Start free

Custom domain emailMore free tools