Enter an email address to validate it and grade its domain security, or enter a domain alone to check SPF, DMARC, DKIM, and MX records.
Enter an email address or domain to inspect
SPF (Sender Policy Framework) publishes a list of IP addresses authorised to send mail for a domain. Without SPF, anyone can forge your From address. A hard-fail policy (-all) tells receiving servers to reject unlisted senders outright.
DMARC (Domain-based Message Authentication, Reporting & Conformance) ties SPF and DKIM together and specifies what to do with messages that fail both checks. Only with a p=reject policy at 100% coverage is your domain fully protected against spoofing.
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing messages so recipients can verify the email was not tampered with in transit. Each signature is tied to a public key published as a DNS TXT record.
MX records declare which mail servers accept email for a domain. Multiple MX records with different priorities provide redundancy - if the primary server is down, mail is queued at the next priority server.
DMARC is worth 35 points - it enforces the other mechanisms. SPF and DKIM are 25 points each. MX quality accounts for 15 points. A+ requires DMARC reject at 100%, a hard-fail SPF, DKIM configured, and redundant MX records. The records are read through VLANlab's own DNS resolver; for a full address, its mail servers are looked up through Cloudflare DNS first. VLANlab's server also connects to the domain's mail server and asks whether it would accept a made-up address, to see whether it accepts every address (catch-all); no mail is sent.