All Email Security Checks — SPF, DKIM, DMARC, Blacklists

AUTHENTICATION

Authentication

Who may send on behalf of your domain — and can it be proven?

SPF Check DNS + IP

Validates your domain's SPF TXT record and whether the sending server is authorized — including a full RFC 7208 audit with recursive lookup counting.

SPF IP Analysis DNS + BL

Recursively resolves every IP in your SPF record and checks each one for blacklist entries, reverse DNS, FCrDNS and ASN ownership.

DKIM Check CRYPTO

Cryptographically verifies the DKIM signature and analyzes algorithm, key strength, signed headers and domain alignment for each individual signature.

DMARC Check DNS + POLICY

Validates the DMARC record, evaluates SPF and DKIM alignment, and audits the policy for weaknesses — including authorization of external report recipients.

ARC Chain Validation FORWARDING

Analyzes the Authenticated Received Chain per RFC 8617 — essential for forwarded email where SPF fails by design.

Envelope-From vs Header-From SPOOFING

Compares the Return-Path address with the visible From header. A mismatch breaks SPF alignment and is a common spoofing indicator.

TRANSPORT

Transport Security

Encryption on the way from server to server.

TLS Transport Analysis ENCRYPTION

Extracts TLS version, cipher suite and key strength from the Received headers and shows the encryption status per hop in the routing path.

MTA-STS & TLS-RPT DNS + HTTPS

Checks whether MTA-STS is correctly set up with DNS record and policy file, and whether TLS-RPT reporting is enabled.

DANE / TLSA DNSSEC

Checks TLSA records for your MX hosts. DANE enables cryptographic certificate verification via DNS and requires DNSSEC.

MX TLS Certificate STARTTLS

Establishes a real STARTTLS connection to your MX servers and fully inspects the presented certificate — from the chain to the expiry date.

STARTTLS Support SMTP

Connects to the sender domain's MX servers and checks whether STARTTLS is offered in the EHLO response.

REPUTATION

Reputation & Blacklists

How your IP, domain and links stand with the major filter lists.

IP Blacklist Check 25 LISTEN

Checks the sending IP against 25 DNS blacklists in parallel — from Spamhaus ZEN to SpamCop and SpamRATS — and shows the return codes of every listing.

Domain Blacklist Check 6 LISTEN

Checks the sender domain against 6 domain-based blacklists. Domain reputation applies independently of the sending IP.

URL Blacklist Check 3 LISTEN

Extracts the domains of all links in the email body and checks them against URI blacklists — the area spam filters weight most heavily.

Homograph / IDN Detection PHISHING

Detects domains with mixed scripts and confusable characters in the sender and links — the technique behind IDN homograph phishing.

CONTENT

Content & Attachments

What spam filters evaluate in the message body and attachments.

Attachment Analysis MALWARE

Detects dangerous file types, double extensions and macro-enabled Office documents among the message attachments.

Body & Spam Analysis SPAM

Analyzes the message body for the spam indicators filters actually score: missing plaintext, tracking pixels, hidden text, shorteners and image-to-text ratio.

Link Verification HTTP

Calls every link in the message body and reports dead links, redirect chains, status codes and SSL errors.

Header Analysis METADATA

Checks headers SpamAssassin-style: Message-ID, date, MIME-Version, Reply-To mismatch, X-Mailer and subject — including the complete routing path.

INFRASTRUCTURE

DNS & Infrastructure

MX records, reverse DNS and the basics of server reputation.

All Security Checks