Skip to main content
PPenTesting.org

Check your email security in one go

Enter your domain to check SPF, DKIM and DMARC together, plus MTA-STS and DNSSEC. You see what to fix first and the exact record to publish for each gap.

Reads public DNS records only, the same ones every mail server reads. We do not keep your domain or the results. Own a domain and want it left out? Publish a TXT record reading exclude at _pentesting-org.yourdomain.

How a receiving mail server checks your domainYour mail server sends a message. The receiving server looks up your public DNS records and asks: Is this mail really from example.com? The message is then delivered, sent to spam or rejected.Your mail serversends as example.commessageReceiving serverSPF · DKIM · DMARCDNS lookupPUBLIC DNSYour public DNS recordsInboxSpamRejectedIs this mail really from example.com?
Every receiving server asks the same question of your public DNS. This check reads the same records.

How the three records work together

  • SPF lists the servers allowed to send for your domain.
  • DKIM signs each message so receivers can tell it really came from you.
  • DMARC tells receivers what to do when both fail, and sends you reports. It is the record that actually stops spoofing, once it is enforced.
The three DMARC policy stepsStart at p=none to collect reports, move to p=quarantine, then p=reject.Monitorp=noneQuarantinep=quarantineRejectp=reject
Monitor: Reports only. Find every service that sends as you.Quarantine: Failing mail goes to spam.Reject: Failing mail is refused outright.

Questions

What does this check look at?

Your public DNS records: SPF, DKIM (at common selectors, or yours), DMARC, your mail servers, MTA-STS and TLS reporting, and DNSSEC. These are the records every receiving mail server reads before deciding what to do with your email.

Does it connect to my servers?

No. It asks a public DNS resolver for your records, the same lookups any mail server makes. Nothing is sent to your mail or web servers.

Why does Gmail care about this?

Since 1 February 2024, Google has required anyone sending email to Gmail accounts to set up SPF or DKIM, and anyone sending more than 5,000 messages a day to set up SPF, DKIM and DMARC. Mail that fails these checks is more likely to be filtered or rejected.

My domain does not send email. Does this matter?

Yes. A domain with no email set-up can still be spoofed. Publishing a null MX record, "v=spf1 -all" and a DMARC policy of reject tells receivers that any mail claiming to be from it is fake.

Is a clean result the same as being secure?

No. These records stop other people sending mail as you. They say nothing about phishing resistance, your mailbox platform or the rest of your systems. A penetration test looks at those.

More email checks

SPF checker →DKIM checker →DMARC checker →

PenTesting.org is an independent editorial directory. We are not an accreditation body or association and are not affiliated with CREST, the NCSC, OWASP, PCI SSC, or ISO. Accreditations are reported from public sources, with the evidence linked on each listing.