All queries run directly in your browser: DNS via DNS-over-HTTPS at Cloudflare (fallback: Google), network holders and countries via the RIPE Stat API, observed DKIM selectors via the public archive archive.prove.email, flag icons from flagcdn.com. A selector you entered yourself is only reported back to the archive if you explicitly click the button in the DKIM card.

What is checked?

Score and spoofing verdict: All results feed into an overall score (0–100). The tool also states, in one sentence, what would actually happen to spoofed mail sent in the domain's name. The report can be copied as Markdown for tickets.
MX records: Which mail servers are responsible for the domain, including provider detection (Microsoft 365, SEPPmail, Proofpoint …), Null MX (RFC 7505) and A fallback. Every server is clickable and reveals IP addresses, PTR with FCrDNS verification, the network holder (ASN) and TLSA status.
DNSSEC: Whether the zone is signed and the resolver validates the answers (AD flag). Without DNSSEC, DANE is ineffective.
SPF: The SPF record is resolved recursively: include and redirect chains are followed and DNS lookups are counted against the limit of 10 (RFC 7208), one of the most common SPF misconfigurations. The tool also calculates how many IPv4 addresses the record authorises to send in total.
DKIM: Around 60 common selectors of major providers (Microsoft 365, Google Workspace, SendGrid, Mailchimp …) are checked automatically, plus every selector the public DKIM archive (prove.email) knows for the domain, so dated or random selectors that no fixed list could guess are found too. Found keys are analysed: type and length (e.g. RSA 2048 or Ed25519), CNAME delegation to services and revoked keys (empty p=); custom selectors can be queried as well.
DMARC: Policy (p=), report addresses and typical mistakes such as duplicate DMARC records or pct<100.
MTA-STS and TLS-RPT: Whether the domain enforces transport encryption by policy and receives TLS reports.
DANE / TLSA: TLSA records on port 25 of the MX hosts, including a warning when TLSA exists without DNSSEC validation.
BIMI: Logo record and Verified Mark Certificate, including a warning when BIMI stays ineffective due to missing DMARC enforcement.

Feedback

Is this tool useful to you? Is a feature missing, or is a result wrong? Feedback right here in the comments is welcome.

Comments are loaded from GitHub / Giscus.