Email & DNS Security Checker

Check a domain's email-authentication posture — SPF, DMARC, DKIM, MX — to spot spoofing and phishing risk.

🛡️ Read-only & safe: this queries public DNS records only (via DNS-over-HTTPS). It performs no scanning or intrusion — the same lookups any mail server makes.

github.comcloudflare.comwikipedia.orggov.uk

—
Email-security posture for

What these records do (and how to fix gaps)

SPF (TXT v=spf1 …) — lists who may send mail for your domain. End with -all to hard-fail spoofers.
DMARC (_dmarc TXT v=DMARC1; p=reject) — tells receivers what to do with mail that fails SPF/DKIM, and where to send reports. p=reject is strongest; start at p=none to monitor.
DKIM — cryptographically signs outgoing mail. Selectors vary per provider, so absence here isn't conclusive.
MX — your mail servers. Present means the domain receives email.
Security headers (for web apps): set Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options: nosniff, X-Frame-Options: DENY, and a strict Referrer-Policy. (Header checks need a server-side fetch — see the proxy in this project.)