Frequently Asked Questions

Your email is analyzed and the technical metadata (headers, DNS records, IP addresses) is evaluated. The actual content of your email and any attachments are not stored. Reports are only accessible via a randomly generated 24-character ID, are not publicly listed, and are blocked from search engines.

The complete analysis with over 20 checks typically takes 10-30 seconds. You'll immediately receive a reply email with your Security Score and a link to the detailed report.

Yes! Just forward any email to hello@analyzemy.email. Note: SPF may fail on forwards since the sending IP changes. This is normal and not a configuration error. ARC (Authenticated Received Chain) helps preserve the original authentication across forwards.

Yes, the service is completely free and usable without registration.

The score (0-100) evaluates the email security configuration based on:

SPF (max 25 points) + DKIM (max 25) + DMARC (max 20) + TLS (max 20) + MX/DNS (max 10) = 100

80-100: Excellent — All important mechanisms are correctly configured.
60-79: Good — Most mechanisms are in place.
40-59: Fair — Important mechanisms are missing.
20-39: Poor — Significant security gaps.
0-19: Critical — Very little authentication detected.

For email marketing: at least 80. Email providers like Gmail and Outlook increasingly filter aggressively on missing authentication.

For business correspondence: 60+ is acceptable. Below 40, you risk emails landing in spam or being rejected entirely.

Since 2024, Google and Yahoo require SPF + DKIM + DMARC for all senders with more than 5,000 emails/day.

Common reasons:

1. Wrong IP: The sending server is not listed in the SPF record. Check that all mail servers you use (including newsletter tools, CRM) are included in SPF.

2. Too many DNS lookups: SPF allows max 10 DNS lookups. Each include:, a:, mx: counts. If exceeded, the result is "permerror".

3. Forwarding: On forwarded emails, the sending IP changes. SPF checks the actual sending IP, not the original one.

SPF checks whether the sending server is authorized to send for the domain. It protects against domain spoofing.

DKIM verifies the cryptographic signature of the message. It confirms the email hasn't been modified and truly comes from the stated sender.

DMARC is the umbrella over SPF and DKIM. It defines what should happen when SPF and/or DKIM fail (reject, quarantine, none) and where reports should be sent.

All three together form the gold standard of email authentication.

"TLS: NONE" means the email was transmitted unencrypted (in plaintext) between the sending server and ours. This is a serious security risk — anyone on the network could read the content.

The fix is on the sending mail server: It must support STARTTLS and offer TLS during connection setup. Most modern mail servers (Google, Microsoft, etc.) do this by default.

MTA-STS (Mail Transfer Agent Strict Transport Security) enforces TLS encryption for incoming emails. Without MTA-STS, an attacker can "downgrade" the TLS connection and intercept mail in plaintext (Man-in-the-Middle).

MTA-STS is recommended for all domains that receive email, especially in regulated industries (finance, healthcare, legal).