The Email Security Analyzer looks up a domain's public email authentication records and grades them A+ to F. It reads DNS only and needs no sign-up. Run it at vigilbase.com/tools/email-security.
Run a check
Enter a domain, for example
example.com.Complete the security check and run the scan.
Read the result. Each record shows what was found, a status and a recommendation.
Email the report, optionally. Enter a work email under the result. See Report by email.
Reserved names such as .test, .example, .local and .internal, and IP addresses, are refused.
What it checks
| Record | What the check reads | Weight |
|---|---|---|
| DMARC | The TXT record at _dmarc.<domain>. With no record there, the organisational domain's policy applies, as receivers do. | 25 |
| SPF | The v=spf1 TXT record at the domain. | 20 |
| DKIM | TXT records at 14 common selectors under _domainkey: google, selector1, selector2, default, dkim, mail, k1, k2, s1, s2, sig1, email, smtp and postmark. | 15 |
| MX | The domain's MX records, and the mail provider they point to. | 10 |
| DNSSEC | Whether a validating resolver authenticates the domain's answers. | 10 |
| MTA-STS | The _mta-sts TXT record and the policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt. | 10 |
| BIMI | The BIMI record and its logo and certificate URLs. | 5 |
| TLS-RPT | The TLS reporting record and its rua address. | 5 |
Each record scores 0 to 100. 80 or more is good, 50 to 79 is a warning and below 50 is bad. A missing record scores 0, including the optional BIMI and TLS-RPT records.
DKIM selectors are not published anywhere, so a domain whose keys use another selector shows DKIM as missing even if it signs mail.
How each record is scored
| Record | Points lost |
|---|---|
| SPF | +all 50, ?all 30, ~all 10, more than 10 lookup terms 20 (8 to 10 cost 10), ptr 10. More than one SPF record scores 30. |
| DMARC | p=none 40, p=quarantine 10, pct below 100 15, no rua 10, a subdomain policy weaker than the main one 5. |
| DKIM | A key at any selector scores 100. None scores 0. |
| MX | Only one MX record 10, an invalid exchange 30, an MX pointing at an IP address 20. |
| DNSSEC | Validated 100, not enabled 0, could not be verified 50. |
| MTA-STS | mode: enforce 100, testing 80, none 50; a record whose policy file cannot be fetched scores 40. |
| BIMI | No logo URL (l=) 50, no mark certificate (a=) 20. |
| TLS-RPT | No reporting address 50. |
The lookup count for SPF covers include:, a:, mx:, ptr: and redirect= in the record itself; it does not follow includes, so the real total can be higher.
How the grade is calculated
The weighted record scores add up to a score out of 100.
| Grade | Score |
|---|---|
| A+ | 90 or more |
| A | 80-89 |
| B | 65-79 |
| C | 50-64 |
| D | 35-49 |
| F | Below 35 |
A missing DMARC record is a critical finding; missing SPF or DKIM is high, missing MX, DNSSEC or MTA-STS is medium, and missing BIMI or TLS-RPT is low.
The status is Vulnerable when there is a critical finding or the grade is F, Warnings for a high-severity finding or grade C or D, and Secure otherwise.
Fix common findings
DMARC not configured
Publish a TXT record at _dmarc.<domain>, starting with v=DMARC1; p=none; rua=mailto:dmarc@example.com to collect reports. The DMARC generator builds one.
DMARC policy is none
Once your reports show every legitimate sender passing, move to p=quarantine, then p=reject.
No SPF record, or more than one
Publish exactly one v=spf1 TXT record that lists every service that sends your mail and ends in ~all or -all. Merge duplicates into one record.
SPF uses ~all or +all
Replace +all at once. Change ~all to -all when every sender is listed.
DKIM not found
Turn on DKIM signing with your mail provider and publish the key it gives you. If your provider uses a selector outside the list above, the check cannot find it; confirm DKIM from a message header (DKIM-Signature: ... s=<selector>) or your provider's console instead.
MTA-STS missing or in testing
Publish the policy file first, then the _mta-sts TXT record. Move from testing to enforce once TLS-RPT reports show no failures.
Focused checkers
The email record checkers run this same scan and explain one record in depth.
Run it from code
The check is on the anonymous Agent API and in the CLI:
npx @vigilbase/cli email example.com