Email Security Checker
One check for everything that protects a domain's email: mail servers, SPF, DKIM, DMARC, MTA-STS, TLS reporting, BIMI and DNSSEC. You get a score, a plain verdict on each part, and where you stand against the Gmail, Yahoo and Outlook.com sender rules.
Email Security Checker
How this lookup works. When you press Check email security, your browser sends the question over encrypted DNS-over-HTTPS to Cloudflare's public resolver (1.1.1.1), or to Google Public DNS (8.8.8.8) if you choose it below. The request goes straight from your device to them. It doesn't pass through ToolFeather: we have no server in the path, so we never see or store the names you look up. Requests are sent without cookies or a referrer. Each resolver has its own privacy policy: Cloudflare · Google.
Results appear here.
Queries your browser sent (0)
These are the exact requests, each one a link. Open one to see the raw JSON answer from the resolver.
Live lookup: your browser asks Cloudflare or Google DNS directly. Nothing passes through ToolFeather.
Scratchpad auto-saved
How it works — in four simple steps
No signup and nothing to install — it all runs in your browser.
Enter your domain
The one in your From: address.
Add a DKIM selector
Optional. Otherwise 30 common selectors are tried.
Run the check
Around 40 lookups go straight from your browser to the resolver.
Work down the list
Fix red, then amber, using the linked tools.
A domain that never sends mail should still publish v=spf1 -all and DMARC p=reject, or anyone can spoof it.
Features
Eight checks, one report
MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT, BIMI and DNSSEC with a weighted 0–100 score and A–F grade.
Bulk-sender checklist
Where the domain stands against the Gmail, Yahoo and Outlook.com requirements, and what DNS can't show.
Real validation
Uses the same engines as the SPF, DMARC and DKIM tools: lookup limits, RFC 9989 tree walk, key sizes.
Parked-domain aware
Recognises null-MX domains and judges them as non-sending.
Drill down
Every row links to the full single-topic check for that domain.
About the Email Security Checker
Email authentication comes in layers, and each one stops a different attack. SPF lists the servers allowed to send for your domain. DKIM signs every message so it can't be forged or changed. DMARC ties both to the From: address people see, and tells receivers to quarantine or reject mail that fails. On the receiving side, MTA-STS (RFC 8461) makes other servers use verified TLS when delivering to you, and TLS-RPT (RFC 8460) reports when they can't. BIMI shows your logo in supporting inboxes once DMARC is enforced, and DNSSEC protects all of these records from forgery.
The checker runs about 40 DNS queries from your browser in parallel and scores the results out of 100. DMARC carries the most weight (25), then SPF and DKIM (20 each), MX (10), MTA-STS and DNSSEC (8 each), TLS-RPT (5) and BIMI (4). Each row links to the dedicated tool for the full detail. Domains with a null MX are treated as non-sending: the right setup for them is v=spf1 -all plus DMARC p=reject, not a mailbox stack.
Since February 2024 Gmail and Yahoo require bulk senders (more than 5,000 messages a day) to have SPF, DKIM and DMARC of at least p=none, with the From: domain aligned. Microsoft brought in the same rules for Outlook.com in May 2025, and Gmail has tightened enforcement since. The report ticks off what DNS can show. Some requirements can't be checked from DNS: alignment in real messages, one-click unsubscribe (RFC 8058) and spam rates below 0.3% need your sending logs and Google Postmaster Tools.