3 of 7 things we check
Email protection
Do your email records (SPF and DMARC) help stop others sending email as you?
What we look at
- An SPF record. One record that lists who may send email for your domain.
- SPF that turns strangers away. It ends by telling mail servers to reject or flag mail from anyone not on the list. Letting everyone through is a High problem.
- SPF that works. Just one SPF record, no more than 10 look-ups, and nothing a mail server won't understand.
- A DMARC record. It tells mail servers what to do with email that fails these checks.
- DMARC that acts. Its policy says to quarantine or reject failing mail, not just to watch.
- DMARC for all your mail. Whether the policy covers every message. Never changes your score.
- DMARC reports. Whether you've asked for reports on who's sending as you. Never changes your score.
- MTA-STS. Whether you ask other mail servers to always use encryption when they send to you. Never changes your score.
- TLS reporting. Whether you've asked for reports when that encryption fails. Never changes your score.
- DKIM. Always shows as Not checked: each DKIM key sits under a name only your email provider knows, and we don't guess it. Never changes your score.
If your domain has no mail servers listed, a missing SPF or DMARC record is a smaller problem, and the report words it to suit.
Why it matters
Anyone can put your address on the From line of an email. SPF and DMARC let the receiving mail server check whether a message really came from you.
With them in place, emails pretending to be your business are more likely to end up in spam or be turned away. They can also help your own email reach people's inboxes.
In our sample report
Here's this part of our sample report for a demo website. example.com is a demonstration domain: we made up what it shows, then ran it through our real checks and report.
Sample report · example.com · illustrative data
Email protection
69 out of 100. 6 of 7 checks completed partial
3 passed · 1 issue · 2 notes · 1 not checked · 3 don't apply
-
Passed SPF record
example.com has an SPF record
-
Passed SPF default policy
example.com's SPF record ends in a restrictive all
-
Passed SPF validity
example.com's SPF record is valid
-
Medium DMARC record
example.com has no DMARC record
For you
Without DMARC, receivers have no domain-published instructions for handling mail that fails authentication, and the owner gets no reports of abuse.
What to do: Publish a DMARC record, starting at p=none while reports are reviewed.
For your IT provider
DNS record
_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:<reports address>"
-
Doesn't apply DMARC policy
No DMARC record was found.
-
Doesn't apply DMARC coverage
DMARC coverage: doesn't apply
-
Doesn't apply DMARC reporting
DMARC reporting: doesn't apply
-
Note MTA-STS
example.com does not publish MTA-STS
-
Note TLS reporting
example.com does not publish TLS-RPT
-
Not checked DKIM
DKIM can't generally be checked from the domain alone, because each signing key is published under a name (a selector) that only the sender knows. The analyser does not guess selectors.
Who fixes it
In your report, anything to fix in this area goes to:
- Your email provider. The records themselves are added at your DNS provider.
What we can't see from outside
We read your public DNS records. We can't see inside your mailbox or your email provider's settings, and we don't send or receive any email. DKIM stays Not checked, as above.