Is your domain set up to stop email spoofing?
Check SPF, DKIM, DMARC and MTA-STS on any domain. Runs live DNS lookups, explains what each result means, and tells you what to fix.
Example result
Sender Policy Framework
SPF record found, soft-fail policy (~all). Servers listed here may send mail as your domain; anything else is marked suspicious rather than rejected.
v=spf1 include:_spf.example-company.com ~allDomainKeys Identified Mail
No DKIM found at the common selectors we checked. That doesn't mean you don't have one — selectors can be named anything, and there's no way to list them. If your provider gave you a selector, check it directly.
Tried: default, google, selector1, selector2, privateemail, k1, dkim, mail, s1, s2Domain-based Message Authentication
No DMARC record. Without one, mailbox providers have no instruction for what to do with mail that fails your SPF and DKIM checks — so spoofed mail in your name can still land in inboxes. Start with p=none to collect reports, then move to quarantine or reject once your senders are aligned.
_dmarc.example-company.com — NXDOMAINMail Transfer Agent Strict Transport Security
MTA-STS policy found and served over HTTPS, but its mode is testing, so it is not being enforced. Sending servers read the policy, report any connection that would have failed it via TLS-RPT, and deliver the mail anyway — nothing is blocked yet. You have no TLS-RPT record, so those reports currently go nowhere and testing mode is collecting nothing. Publish TLS-RPT first, then move to mode: enforce once the reports it gathers are clean.
mode: testing · max_age 604800SMTP TLS Reporting
No TLS-RPT record, and your MTA-STS policy is in testing mode. Testing mode exists to collect failure reports without blocking anything — so without a TLS-RPT record it is collecting nothing, and the usual next step of moving to mode: enforce once the reports are clean cannot be reached, because no report will ever arrive. Publishing TLS-RPT is the prerequisite: one TXT record at _smtp._tls naming a mailbox or an HTTPS endpoint.
No v=TLSRPTv1 record at _smtp._tlsDNS-Based Authentication of Named Entities
No TLSA records are published for this domain's mail servers (mx1.example-company.com, mx2.example-company.com), so DANE is not in use. That is not a misconfiguration — DANE is optional, and MTA-STS above covers the same ground with a different trust anchor. Those hostnames are inside example-company.com, so these are records you publish and can change.
no TLSA record at _25._tcp.mx1.example-company.comWant this fixed properly? Socotra Enterprises configures SPF, DKIM, DMARC and MTA-STS as part of hosting and operations.
Get it set up →Example result · public DNS lookups only · nothing stored · no account