// CHECK YOUR DOMAIN
Can someone send email in your name?
Type your domain. We ask its own name servers and show what an attacker sees: whether your email and your DNS can be forged, and what to fix first.
How we score
100 points in all, for the four protections every domain needs, weighted by what each one protects against.
- DMARC: reject 45; quarantine 34; none 5; missing or invalid 0. With pct below 100, the share of mail outside pct counts at the next weaker policy, rounded to whole points.
- SPF: -all 20; ~all 16; ?all, +all or no closing rule 3; missing, invalid or unknown 0. A redirect scores as the record it points to.
- DKIM: key found 15; none found or unknown 4; only revoked or malformed keys 2. None found still earns points, because a key can sit under a name we did not try.
- DNSSEC: signed and validated 20; anything else 0.
- A domain that takes no mail (no MX, or a null MX) is not scored on DKIM. It earns those points by saying it neither sends nor takes mail: null MX 7; SPF -all 4; DMARC reject 4.
- Name servers that do not answer cap the score at 20.
MTA-STS, TLS reporting, DANE and CAA earn no points. Whether you need them depends on your sector and the rules you work under, so we show them separately as additional protection.
0 to 39 open, 40 to 69 partly protected, 70 to 89 good, 90 to 100 excellent.