Domain Analyser
One scan of every email-authentication record on a domain.
Enter a domain to run a full email-authentication scan in one go. We check DMARC, SPF, MX, MTA-STS and BIMI live over an encrypted connection, score each control and give you an overall posture. Nothing is stored.
The Domain Analyser runs one scan that pulls every email-authentication record published for a domain and shows them side by side. Instead of checking DMARC, SPF and DKIM separately, you get the full picture in a single view: DMARC policy, SPF mechanisms, DKIM selectors it can find, plus the supporting records that modern receivers increasingly look for, namely MTA-STS, TLS-RPT, BIMI, DNSSEC and CAA.
What a complete record set looks like
A well-configured domain typically shows a DMARC record at enforcement (p=quarantine or p=reject), exactly one SPF record ending in -all or ~all and within the ten-lookup limit, at least one valid DKIM key, and an MTA-STS policy file served over HTTPS at mta-sts.<domain>/.well-known/mta-sts.txt. BIMI and a Verified Mark Certificate are optional extras that only work once DMARC is at enforcement.
Reading and fixing the result
Each record is reported as present, missing or misconfigured. The usual problems and their fixes:
- Two SPF records: only one TXT record beginning
v=spf1is permitted; a second causes apermerrorand SPF stops working entirely. Merge them into one. - DMARC on
p=none: monitor-only, so spoofed mail is still delivered. Tighten toquarantinethenreject. - No MTA-STS or TLS-RPT: without these, downgrade attacks on inbound TLS are possible and you get no reporting on delivery failures.
- BIMI published without enforcement: BIMI is ignored unless DMARC is at
quarantineorreject, and Gmail and Apple require a VMC for the logo to display.
Use this scan as a baseline, then work through gaps against our requirements checklist. If you would rather not maintain all of this by hand, DMARC Engine can host and manage these records for you; the free tools are here to diagnose first.
Frequently asked questions
What records does the Domain Analyser check?
It scans the full email-authentication stack: DMARC, SPF and discoverable DKIM selectors, plus MTA-STS, TLS-RPT, BIMI, DNSSEC and CAA. The goal is one scan that surfaces every record a receiving server might consult, rather than checking each in isolation.
Why can't it always find my DKIM record?
DKIM keys are stored under a selector at selector._domainkey.yourdomain, and selectors are chosen freely by each sending platform, so they cannot be enumerated from DNS alone. The analyser probes common selectors, but if yours is unusual it may not appear. Check the s= tag in a real message's DKIM-Signature header to confirm your selector.
Do I need MTA-STS and TLS-RPT as well as DMARC?
They solve a different problem. DMARC stops spoofing of your From address, while MTA-STS (RFC 8461) enforces TLS on inbound mail to your servers and TLS-RPT (RFC 8460) reports any failures. They complement DMARC rather than replace it, and a thorough setup has both.
The scan says BIMI is present but my logo isn't showing. Why?
BIMI has prerequisites the record alone does not satisfy. Your DMARC policy must be at enforcement (p=quarantine or p=reject), the logo must be SVG Tiny PS, and Gmail and Apple Mail require a Verified Mark Certificate. If any of these is missing the logo is suppressed even though the BIMI record validates.
Is DNSSEC required for email authentication?
No, DMARC, SPF and DKIM work without it. DNSSEC adds cryptographic integrity to DNS answers, which protects against tampered records and is a prerequisite for DANE/TLSA. The analyser reports it because it strengthens the overall trust chain, but it is optional for basic authentication.
How do I fix a domain showing two SPF records?
RFC 7208 allows only one TXT record starting with v=spf1. Combine the mechanisms from both records into a single SPF record and delete the duplicate. Leaving two in place causes a permanent error and disables SPF evaluation entirely.