Is your mail landing in spam? Could someone send phishing in your name? Enter your domain and see within seconds how well it is protected.
What is checked?
| Check | Purpose |
|---|---|
| MX | Which servers accept mail for your domain — and which provider is behind them (Microsoft 365, Google Workspace, IONOS …)? |
| SPF | Which servers may send mail as your domain? We check syntax, the “all” mechanism, duplicate records and the 10 DNS lookup limit including all nested includes. |
| DKIM | Is your mail cryptographically signed? We probe common selectors (Microsoft 365, Google, Mailchimp and more) and the key length. You can enter your own selector. |
| DMARC | What should receivers do with spoofed mail — nothing, spam or reject? And do you receive reports? |
| MTA-STS, TLS-RPT, BIMI | Additional protections for encrypted delivery and brand display. |
| DNSSEC | Are your DNS answers signed? |
Why it matters
Since February 2024 Google and Yahoo require SPF, DKIM and DMARC from senders — without them, mail is more likely to be flagged as spam or rejected. Microsoft followed for Outlook.com. A domain without DMARC is also an open door for CEO fraud and phishing.
Reading the result
- 80–100 points: well protected. Polish: DMARC to
reject, add MTA-STS. - 50–79 points: basics in place, but gaps — usually DMARC at
noneor missing DKIM. - below 50 points: high risk. Add missing SPF or DMARC soon.
Where something is missing, the tool shows a suggested DNS record to copy. Use the DMARC generator and SPF generator tabs to build your own.
FAQ
Can DKIM be fully checked from outside?
Not entirely: DKIM keys live under a freely chosen “selector”. We test the common ones. Your selector is in the header of a sent mail (DKIM-Signature: … s=selector).
Is my data stored? No. Queries go straight from your browser to Cloudflare (1.1.1.1) via DNS-over-HTTPS. Digitriva sees neither your domain nor the result.