Email authentication check

Read what your domain's public DNS says about SPF, DMARC, DKIM and MTA-STS — the records a cyber-insurance questionnaire asks you to attest to.

Reads public DNS only. No scan against your servers, nothing installed, nothing stored. Every result shows the resolver and the UTC time it was read.

What it checks

SPF — is a sender policy published, and does it actually reject forgeries (-all) or only softfail (~all)?
DMARC — is a policy published, and is it enforcing (quarantine/reject) or only reporting (p=none)?
DKIM — is a signing key findable at the common selectors? (A miss is "not found here", never "unsigned".)
MTA-STS — is transport-security enforcement published?

Built by Florian Standhartinger while developing a monthly security-and-compliance report for small MSPs. It is offered free and unconditionally: no sign-up, no price, no follow-up, and nothing you enter is stored. The check reads only public DNS.

Sources: your domain's public DNS, read over DNS-over-HTTPS from Cloudflare and Google. Records are shown verbatim so you can re-run any query yourself — e.g. dig +short TXT _dmarc.yourdomain.com.