ToolsEmail

Email security check

Everything that protects a domain's email in one report: mail servers, SPF, DMARC, DKIM, MTA-STS, TLS reporting, BIMI and DNSSEC. Each area gets a verdict, and the most important fixes come first.

Checks run in your browser
DNS and the MTA-STS policy fetched via abbott.cloud

Domain

How this works

Your browser works out every DNS question the check needs: the MX records and each mail server's addresses, the SPF record and everything it includes, the DMARC record (and, for a subdomain, the parent domain's), 27 common DKIM selectors, and the MTA-STS, TLS reporting and BIMI records.
Browsers can't send DNS packets themselves, so this page posts them to abbott.cloud/api/dns, which forwards them unchanged to Cloudflare's resolver (1.1.1.1) using DNS over HTTPS. Questions asked at the same moment travel together, up to 20 per request, so the whole check takes a handful of requests.
The MTA-STS policy is a file on a web server, at mta-sts. followed by the domain. abbott.cloud/api/mta-sts fetches it without following redirects, as RFC 8461 §3.3 requires, and returns the text unchanged.
Everything else happens on your device. This page decodes the answers, applies RFC 7208 (SPF), RFC 7489 (DMARC), RFC 6376 (DKIM), RFC 8461 (MTA-STS), RFC 8460 (TLS reporting) and RFC 7505 (null MX), and builds the scorecard. The resolver's AD flag on each answer says whether it validated it with DNSSEC.

What's kept: nothing. The domain goes in the page's address so you can share the report. The resolver sees the questions arrive from Cloudflare's network, and the MTA-STS web server sees the request come from abbott.cloud, not from your IP address.

Limitations:

DNS can't list a domain's DKIM selectors, so only common ones are tried. A miss doesn't mean there's no DKIM.
Browsers can't connect to mail servers, so STARTTLS, mail server certificates and DANE aren't tested.
BIMI logos and mark certificates aren't downloaded or checked.
Answers can come from the resolver's cache, so a change can take up to the record's TTL to show.

Code: email.js (this page), emailcheck.js (scorecard, fixes and DNSSEC), spf.js, dmarc.js, dkim.js, dkimcheck.js, mailpolicy.js (MX, MTA-STS, TLS reporting and BIMI), net.js (requests).