Security Tools
🩺 SPF / DMARC / DKIM Auditor
Enter a domain and check live whether it is protected against email spoofing. We query its SPF, DMARC and DKIM over DNS-over-HTTPS, grade them, tell you what fails and —depending on where you are— lay out the phased plan to p=reject without breaking legit mail.
📊 And big companies? This is how the IBEX 35 and other indices in Europe and the US fare →
🔔 Watch your domain: we tell you if its protection changes · analyze your DMARC reports · step-by-step guides by provider · public API (JSON)
📐 How we score · methodology 2026.2
The grade combines SPF (35%), DMARC (40%) and DKIM (25%). It is the same in this auditor, on each result’s shareable page, in the badge and in the Posture Radar.
Capped by real protection. The grade cannot be better than the anti-spoofing protection your DMARC policy provides: without DMARC, anyone can spoof your domain in the visible sender, however good SPF and DKIM are.
| DMARC policy | Maximum grade |
|---|---|
No DMARC | F |
Invalid p policy | F |
p=none | D |
p=quarantine · pct<100 | C |
p=quarantine | B |
p=reject · pct<100 | B |
p=reject | no cap |
Undetected DKIM is not penalised. Without knowing the selector, DKIM cannot be discovered through DNS, and many organisations use custom selectors. If we do not find it with the common ones, the grade comes from SPF and DMARC only. If we find it and it is wrong (revoked or 1024-bit key), it does count.
Extras that do not count. We also show MTA-STS, TLS-RPT, BIMI, DNSSEC and CAA: they protect mail in transit and your brand, but they are not part of the grade. For MTA-STS we read the DNS record, not the policy published over HTTPS.
Scale: A ≥ 90 · B ≥ 75 · C ≥ 55 · D ≥ 35 · F < 35.
We only read public DNS records: the ones any mail server looks up when it receives a message from you. We send no mail and never connect to your servers.