DomainDNSCheck
Email security

Email Security Center

One check for everything that protects a domain against spoofing and insecure delivery — explained, with the fixes that matter most first.

For example example.com — URLs and email addresses are accepted too.

Selectors cannot be discovered reliably from DNS. Find yours in a message header: DKIM-Signature … s=selector.

What the center checks

MX
Which servers receive mail, whether they resolve and whether they use public addresses.
SPF
The record syntax, qualifiers, include and redirect chains, loops and the 10-DNS-lookup limit.
DMARC
Policy (none, quarantine, reject), subdomain policy, percentage, alignment and report destinations.
DKIM
The public key for the selector you provide: presence, type, size, revocation and syntax.
MTA-STS
The policy file, its mode, the MX patterns it covers and max_age.
TLS-RPT
Where reports about failed encrypted deliveries are sent.
BIMI
The logo record and whether authority evidence is referenced — never a claim of brand verification.

A rating you can check

The posture rating follows published, versioned rules. Every point deducted is listed with its reason, missing optional features do not count as failures, and anything that could not be checked is excluded instead of guessed.

Every domain starts at 100. Only the findings below deduct points; unknown results never do. Strong requires at least 90 and no critical problem, Good 75, Needs attention 50.

BIMI is not brand verification

A BIMI record only publishes a logo location. DomainDNSCheck does not verify brand ownership; mailbox providers decide whether a logo is shown.