Two layers: your email and your domain
Email security depends on DNS records that tell receiving servers which systems may send for your domain and what to do with messages that fail the test. Those records only help if the domain itself is reliable: correctly delegated, not about to expire and not on a blocklist. This audit checks both layers in one run.
- MX records, your email provider and STARTTLS with a valid certificate on each mail server.
- SPF record, its policy strength and the ten-lookup limit, with the include tree.
- DKIM keys on common selectors and their key length.
- DMARC policy, coverage, subdomain policy, alignment and reporting address.
- MTA-STS, TLS-RPT, BIMI readiness and an overall spoofing risk rating.
- Nameservers, SOA, DNSSEC, CAA, registrar and expiry date, and domain and server IPs on major blocklists.
Why it matters for firms
Payment-diversion fraud often relies on emails that appear to come from a law firm, notary or accountant, asking a client to send money to a new account. Without a DMARC policy of quarantine or reject, receivers have no instruction to refuse forged mail from your exact domain. With it, a large class of these attacks fails before it reaches the inbox.
Since 2024, Google and Yahoo require bulk senders to authenticate with SPF and DKIM and publish DMARC, and well-configured authentication helps every sender's deliverability. Encrypted transport with STARTTLS and MTA-STS protects confidential correspondence in transit.
Reading the results
The spoofing risk badge summarises how easy it would be to send convincing forged email from your domain: critical, medium or low, with the reasons. Domains that send no mail at all are recognised when they publish a null MX, an SPF -all and DMARC reject, and are treated as fully protected.
Move DMARC from none to quarantine and then reject once your reports show all legitimate senders — your mailbox provider, invoicing tool, newsletter service — pass SPF or DKIM in alignment. The report gives the exact DNS records to publish.
Who should own this
Email and domain settings often sit between your IT provider, your web agency and your mailbox provider, and nobody feels responsible. Agree who owns the DNS records, who reads DMARC reports and who renews the domain. Share this report with them and repeat the audit after every change to your email setup.