Is your domain set up to stop email spoofing?
Check SPF, DKIM, DMARC and MTA-STS on any domain. Runs live DNS lookups, explains what each result means, and tells you what to fix.
Example result
Sender Policy Framework
SPF record found, soft-fail policy (~all). Servers listed here may send mail as your domain; anything else is marked suspicious rather than rejected.
v=spf1 include:_spf.example-company.com ~allDomainKeys Identified Mail
No DKIM found at the common selectors we checked. That doesn't mean you don't have one — selectors can be named anything, and there's no way to list them. If your provider gave you a selector, check it directly.
Tried: default, google, selector1, selector2, privateemail, k1, dkim, mail, s1, s2Domain-based Message Authentication
No DMARC record. Without one, mailbox providers have no instruction for what to do with mail that fails your SPF and DKIM checks — so spoofed mail in your name can still land in inboxes. Start with p=none to collect reports, then move to quarantine or reject once your senders are aligned.
_dmarc.example-company.com — NXDOMAINMail Transfer Agent Strict Transport Security
MTA-STS policy found and served over HTTPS, but its mode is testing, so it is not being enforced. Sending servers read the policy, report any connection that would have failed it via TLS-RPT, and deliver the mail anyway — nothing is blocked yet. Move to mode: enforce once your TLS-RPT reports are clean.
mode: testing · max_age 604800Want this fixed properly? Socotra Enterprises configures SPF, DKIM, DMARC and MTA-STS as part of hosting and operations.
Get it set up →Example result · public DNS lookups only · nothing stored · no account