Email security

Checks

• dns.missing-spf medium No SPF record
• dns.soft-spf low SPF uses soft-fail
• dns.missing-dmarc medium No DMARC record
• dns.dmarc-none low DMARC policy is p=none
• dns.missing-mta-sts low No MTA-STS policy
• dns.mta-sts-policy-unreachable medium MTA-STS policy file could not be fetched
• dns.mta-sts-testing low MTA-STS policy is in testing mode
• dns.mta-sts-none low MTA-STS policy mode is none
• dns.mta-sts-mx-mismatch medium MTA-STS policy does not cover every MX host
• dns.missing-tlsrpt info No TLS-RPT record

MTA-STS and TLS-RPT are only raised for domains that receive mail (have MX records). The MTA-STS check covers both halves: the _mta-sts TXT record and the policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt, and whether the policy's mx lines cover every MX host in DNS.

Changes that alert

SPF getting broader, DMARC moving to a weaker policy, and changes to MX, NS and CAA records all appear in the change feed. An unexpected NS or MX change is what domain or mailbox takeover looks like from outside.

Lookalike domains

Growth and above watch registrations that imitate your domains: typos, homoglyphs, TLD swaps and added words. Lookalikes are observed through public DNS and certificate transparency only; they are never scanned or connected to. A lookalike with MX records or a fresh certificate is the one to worry about: it can send and receive mail or serve a login page.

Free tools

The SPF and DMARC checker and the lookalike domain checker run the same logic in your browser with no signup.