# Email record checkers

> Focused SPF, DMARC, DKIM, BIMI and MTA-STS checkers that run the Email Security scan and explain one record in depth.

Source: https://docs.vigilbase.com/tools/email-checkers

Five focused checkers each explain one email authentication record. They all run the full [Email security](https://docs.vigilbase.com/tools/email-security) scan, so they also grade the rest of the domain, and you can email yourself that report.

| Checker | Address | Looks at |
| --- | --- | --- |
| SPF Checker | [/tools/spf-checker](https://vigilbase.com/tools/spf-checker) | The SPF record and its DNS lookup count |
| DMARC Checker | [/tools/dmarc-checker](https://vigilbase.com/tools/dmarc-checker) | The DMARC policy and reporting address |
| DKIM Checker | [/tools/dkim-checker](https://vigilbase.com/tools/dkim-checker) | DKIM public keys under 14 common selectors |
| BIMI Checker | [/tools/bimi-checker](https://vigilbase.com/tools/bimi-checker) | The BIMI record at the `default` selector, and whether DMARC meets BIMI's requirement |
| MTA-STS Checker | [/tools/mta-sts-checker](https://vigilbase.com/tools/mta-sts-checker) | The MTA-STS record, its policy file and the TLS-RPT record |

## SPF

The record starts at 100 and loses points for each problem. SPF carries 20 of the 100 points in the email security grade.

| Problem | Effect | Fix |
| --- | --- | --- |
| No SPF record | Scores 0 | Publish one TXT record that lists your mail services and ends in `~all` or `-all`. A domain that sends no mail publishes `v=spf1 -all`. |
| More than one SPF record | Scores 30 | Merge the mechanisms into one record and delete the others. Receivers return `permerror`. |
| `+all` | Costs 50 | Replace it with `-all`, or `~all` while you confirm every sender. |
| `?all` | Costs 30 | Use `-all`, or `~all` while you test. |
| `~all` | Costs 10 | Change to `-all` once DMARC reports show every legitimate sender passing. |
| More than 10 lookup terms | Costs 20 (8 to 10 cost 10) | Remove unused services, or move some senders to a subdomain with its own SPF record. |
| `ptr` | Costs 10 | Replace it with `ip4`, `ip6`, `a` or `include`. |

The lookup count covers `include:`, `a:`, `mx:`, `ptr:` and `redirect=` in the record itself and does not follow includes, so the real total can be higher. A record with `-all` and too many lookups can still score 80, but receivers return `permerror` for it, so fix the lookups first.

## DMARC

DMARC carries 25 of the 100 points, more than any other record.

| Record | Effect |
| --- | --- |
| `p=reject` | Full credit |
| `p=quarantine` | Costs 10 |
| `p=none` | Costs 40 |
| `pct` below 100 | Costs 15 |
| No `rua` | Costs 10 |
| `sp=none` with a stricter `p` | Costs 5 |
| Inherited record | With no record at the name, the organisational domain's `sp` (or `p` without `sp`) is scored: reject 100, quarantine 75, none 50, minus 15 when `pct` is below 100 |

Start with `p=none` and a `rua` address, then move to `quarantine` and `reject` as reports show legitimate mail passing.

## DKIM

DKIM carries 15 of the 100 points. If any of the 14 selectors has a TXT record containing `v=DKIM1` or `p=`, DKIM scores 100. With only one selector you get a suggestion to publish a second for key rotation. With none, DKIM scores 0 and the result lists the selectors tried. Keys under other selectors are not found.

## BIMI

BIMI is optional and carries 5 of the 100 points. A record with `l=` and `a=` gets full credit; no `a=` costs 20 and no `l=` costs 50.

- **DMARC not at enforcement.** BIMI needs `p=quarantine` or `p=reject` for the domain and its subdomains, with no `pct` below 100.
- **No logo URL.** Host the logo as an SVG Tiny PS file over HTTPS and add its URL in `l=`.
- **No mark certificate.** Get a Verified Mark Certificate (VMC) or Common Mark Certificate (CMC), host the PEM file over HTTPS and add its URL in `a=`.

```text
default._bimi.example.com TXT "v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/vmc.pem"
```

## MTA-STS and TLS-RPT

MTA-STS carries 10 of the 100 points and TLS-RPT carries 5.

| Policy | Score |
| --- | --- |
| `mode: enforce` | 100 |
| `mode: testing` | 80 |
| `mode: none` | 50 |
| A policy file without a mode the check can read | 70 |
| A TXT record without a policy file the check can fetch | 40 |
| TLS-RPT with a `rua` address | 100, or 50 without one |

- **Policy file not reachable.** Publish it at `/.well-known/mta-sts.txt` on the `mta-sts` host, served as `text/plain` over HTTPS with a valid certificate.
- **Testing mode left on.** Once TLS-RPT reports show no failures, change the mode to `enforce` and change the `id` in the TXT record.
- **No MTA-STS record.** Publish the policy file first, then the TXT record:

```text
_mta-sts.example.com TXT "v=STSv1; id=20261018T000000"
```

## Build a record

The [SPF and DMARC generators](https://docs.vigilbase.com/tools/record-generators) write new records in your browser.