Email Privacy Auditor

Email authentication is a set of DNS-published policies that prove your domain is who it claims to be. Without them, anyone can forge email that appears to come from your address. The mechanism behind phishing, business email compromise, and brand impersonation. This auditor performs five live DNS checks to assess exactly how exposed a domain is, scoring the result on a 0-10 risk scale and providing the exact DNS record fix for every gap found.

The risk score reflects real-world spoofing exposure. A domain with no SPF record and no DMARC policy has no technical barrier preventing someone from sending convincing phishing emails to your customers or partners using your domain name. A domain with SPF -all, DMARC p=reject, and DKIM configured has the strongest available protection. Every major receiving mail server is instructed to reject unauthenticated messages claiming that domain as the sender.

Each failing or warned check includes the specific DNS record value to add or modify, the exact v=spf1 string, the _dmarc TXT value, or the DKIM key publication path, so you can act on the results immediately. The Google and Yahoo 2024 bulk sender requirements mandate valid SPF, DKIM, and a DMARC record for senders of more than 5,000 daily messages to Gmail. This audit confirms compliance with those requirements at a glance.

Every unprotected domain is an attack surface. Phishing campaigns routinely impersonate legitimate brands using spoofed From: addresses. And the organisations whose domains are being spoofed often have no idea it is happening because they have no DMARC aggregate reports configured. From the attacker's perspective, a domain with no SPF and no DMARC is free to use: no authentication barrier, no rejection policy, and no reporting mechanism to alert the domain owner. This auditor exposes that exposure in seconds.

The most dangerous gap is a domain with DMARC p=none. This is the configuration many organisations end up with after following a "set it up safely" guide that recommends starting with monitoring mode. And then never advancing. A p=none record creates the appearance of DMARC coverage while providing zero enforcement. Spoofed phishing emails using the domain still reach inboxes. The only difference from having no DMARC is that aggregate reports are generated. But if no one is reading them, nothing changes. The risk score specifically flags this pattern because it is so common and so consequential.

For security-conscious organisations, running this audit across your full domain portfolio, including acquired, legacy, parked, and internal-use domains, takes seconds per domain and immediately surfaces the highest-priority gaps. Non-sending parked domains are particularly at risk: they typically have no authentication records at all, making them easy targets for phishing campaigns that exploit the name recognition of an established brand. Publishing SPF v=spf1 -all, DMARC p=reject, and a null MX record on every non-sending domain eliminates these as attack vectors entirely.

For organisations evaluating vendor or partner domains before granting email-based access or adding contacts to a mailing list, this audit provides instant insight into how seriously the counterparty takes email security. A useful signal alongside other due diligence criteria.

Most domains scoring above 3 have one or two specific issues accounting for the majority of risk points. Here is what each common problem means and how to resolve it.

SPF (Sender Policy Framework, RFC 7208) is the sender authorisation layer. Published as a TXT record at your root domain, it lists every IP address and mail service authorised to send email on your behalf. When a receiving server gets a message from your domain, it checks whether the sending IP is in your SPF record. SPF validates the SMTP envelope sender, the hidden MAIL FROM address, not the visible From: header. This is why SPF alone cannot prevent From: header spoofing, and why DMARC alignment is needed on top. Use the SPF Record Checker for a mechanism-by-mechanism audit, or the SPF Flattening Tool if your include chain is approaching the 10-lookup RFC limit.

DKIM (DomainKeys Identified Mail, RFC 6376) is the signing layer. It adds a cryptographic signature to outgoing messages, tied to a domain you control in the d= tag. Receiving servers retrieve the public key from DNS at selector._domainkey.yourdomain.com and verify the signature. Confirming the message was not altered in transit. Because the DKIM signature is based on your domain rather than the sending server's IP, it survives email forwarding and is the more reliable alignment mechanism for third-party sending platforms. Use the DKIM Analyzer for full key inspection including strength estimation and revocation status.

DMARC (Domain-based Message Authentication, Reporting, and Conformance, RFC 7489) is the policy and reporting layer. It requires that at least one mechanism, SPF or DKIM, passes with alignment to the visible From: header. It then specifies what to do when neither passes: none (monitor), quarantine (spam), or reject (block). It also generates daily aggregate XML reports from major mailbox providers showing pass/fail rates across all sending sources. DMARC is the mechanism that gives SPF and DKIM real enforcement value. Without it, even perfectly configured SPF and DKIM cannot prevent From: header spoofing. Use the DMARC Checker for a policy health summary or the DMARC Analyzer for a full tag-by-tag breakdown.

MX records are the routing layer. They tell the internet which mail server accepts inbound email for your domain. Without MX records, email cannot be delivered to the domain. For non-sending domains, a null MX record (priority 0, value '.') explicitly signals no inbound mail, which is the correct configuration for parked or purely outbound-only domains.

BIMI (Brand Indicators for Message Identification) is the brand display layer. Optional but increasingly common at enterprise level. It displays your logo next to emails in Gmail, Apple Mail, and Yahoo Mail. It has no direct security function but requires DMARC enforcement to be in place (p=quarantine or p=reject with pct=100), which means a BIMI record is an indirect signal that a domain has reached a mature authentication posture.