Email record checkers

Focused SPF, DMARC, DKIM, BIMI and MTA-STS checkers that run the Email Security scan and explain one record in depth.

Five focused checkers each explain one email authentication record. They all run the full Email security scan, so they also grade the rest of the domain, and you can email yourself that report.

Checker	Address	Looks at
SPF Checker	/tools/spf-checker	The SPF record and its DNS lookup count
DMARC Checker	/tools/dmarc-checker	The DMARC policy and reporting address
DKIM Checker	/tools/dkim-checker	DKIM public keys under 14 common selectors
BIMI Checker	/tools/bimi-checker	The BIMI record at the `default` selector, and whether DMARC meets BIMI's requirement
MTA-STS Checker	/tools/mta-sts-checker	The MTA-STS record, its policy file and the TLS-RPT record

SPF

The record starts at 100 and loses points for each problem. SPF carries 20 of the 100 points in the email security grade.

Problem	Effect	Fix
No SPF record	Scores 0	Publish one TXT record that lists your mail services and ends in `~all` or `-all`. A domain that sends no mail publishes `v=spf1 -all`.
More than one SPF record	Scores 30	Merge the mechanisms into one record and delete the others. Receivers return `permerror`.
`+all`	Costs 50	Replace it with `-all`, or `~all` while you confirm every sender.
`?all`	Costs 30	Use `-all`, or `~all` while you test.
`~all`	Costs 10	Change to `-all` once DMARC reports show every legitimate sender passing.
More than 10 lookup terms	Costs 20 (8 to 10 cost 10)	Remove unused services, or move some senders to a subdomain with its own SPF record.
`ptr`	Costs 10	Replace it with `ip4`, `ip6`, `a` or `include`.

The lookup count covers include:, a:, mx:, ptr: and redirect= in the record itself and does not follow includes, so the real total can be higher. A record with -all and too many lookups can still score 80, but receivers return permerror for it, so fix the lookups first.

DMARC

DMARC carries 25 of the 100 points, more than any other record.

Record	Effect
`p=reject`	Full credit
`p=quarantine`	Costs 10
`p=none`	Costs 40
`pct` below 100	Costs 15
No `rua`	Costs 10
`sp=none` with a stricter `p`	Costs 5
Inherited record	With no record at the name, the organisational domain's `sp` (or `p` without `sp`) is scored: reject 100, quarantine 75, none 50, minus 15 when `pct` is below 100

Start with p=none and a rua address, then move to quarantine and reject as reports show legitimate mail passing.

DKIM

DKIM carries 15 of the 100 points. If any of the 14 selectors has a TXT record containing v=DKIM1 or p=, DKIM scores 100. With only one selector you get a suggestion to publish a second for key rotation. With none, DKIM scores 0 and the result lists the selectors tried. Keys under other selectors are not found.

BIMI

BIMI is optional and carries 5 of the 100 points. A record with l= and a= gets full credit; no a= costs 20 and no l= costs 50.

DMARC not at enforcement. BIMI needs p=quarantine or p=reject for the domain and its subdomains, with no pct below 100.
No logo URL. Host the logo as an SVG Tiny PS file over HTTPS and add its URL in l=.
No mark certificate. Get a Verified Mark Certificate (VMC) or Common Mark Certificate (CMC), host the PEM file over HTTPS and add its URL in a=.

Text

default._bimi.example.com TXT "v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/vmc.pem"

MTA-STS and TLS-RPT

MTA-STS carries 10 of the 100 points and TLS-RPT carries 5.

Policy	Score
`mode: enforce`	100
`mode: testing`	80
`mode: none`	50
A policy file without a mode the check can read	70
A TXT record without a policy file the check can fetch	40
TLS-RPT with a `rua` address	100, or 50 without one

Policy file not reachable. Publish it at /.well-known/mta-sts.txt on the mta-sts host, served as text/plain over HTTPS with a valid certificate.
Testing mode left on. Once TLS-RPT reports show no failures, change the mode to enforce and change the id in the TXT record.
No MTA-STS record. Publish the policy file first, then the TXT record:

Text

_mta-sts.example.com TXT "v=STSv1; id=20261018T000000"

Build a record

The SPF and DMARC generators write new records in your browser.