Security Tools
🩺 SPF / DMARC / DKIM Auditor
Enter a domain and check live whether it is protected against email spoofing. We query its SPF, DMARC and DKIM over DNS-over-HTTPS, grade them, tell you what fails and —depending on where you are— lay out the phased plan to p=reject without breaking legit mail.
📐 How we score · methodology 2026.2
The grade combines SPF (35%), DMARC (40%) and DKIM (25%). It is the same in this auditor, on each result’s shareable page, in the badge and in the Posture Radar.
Capped by real protection. The grade cannot be better than the anti-spoofing protection your DMARC policy provides: without DMARC, anyone can spoof your domain in the visible sender, however good SPF and DKIM are.
| DMARC policy | Maximum grade |
|---|---|
No DMARC | F |
Invalid p policy | F |
p=none | D |
p=quarantine · pct<100 | C |
p=quarantine | B |
p=reject · pct<100 | B |
p=reject | no cap |
Undetected DKIM is not penalised. Without knowing the selector, DKIM cannot be discovered through DNS, and many organisations use custom selectors. If we do not find it with the common ones, the grade comes from SPF and DMARC only. If we find it and it is wrong (revoked or 1024-bit key), it does count.
Scale: A ≥ 90 · B ≥ 75 · C ≥ 55 · D ≥ 35 · F < 35.
We only read public DNS records: the ones any mail server looks up when it receives a message from you. We send no mail and never connect to your servers.