tamper[box]

Email authentication tools

Investigate public mail routing and authentication records before changing DNS. MX, SPF, DKIM and DMARC answer different questions; publishing valid records does not prove that a message will arrive or pass authentication.

Choose a check

Start with MX and provider lookup for inbound routing. For outgoing authentication, inspect SPF includes, the DKIM selector from a sent message and the DMARC policy. Compare these records with headers from a message received by a system you trust. MTA-STS and BIMI cover separate transport and logo-publication tasks.

Tools in this collection

    • Check where a domain receives mail before changing its setup.
    • Moving to a new mail host? See where mail is delivered today.
    • Several MX hosts? See which one receivers try first.
    • No MX at all? Check whether mail falls back to address records.
    • Domain never handles mail? Confirm it says so with a null MX.

    Check MX, null MX and address fallback with live DNS evidence.

  • Email Provider Lookup

    Runs on server
    • Taking over a domain? Find out who handles its email.
    • Planning a migration? Confirm the current host before you cut over.
    • Researching a company? See if it runs Google Workspace or Microsoft 365.
    • Mail filtered before the inbox? Spot a gateway like Mimecast.
    • Unfamiliar MX names? See which provider they match and why.

    Identify email hosts and gateways from MX records, with matching evidence.

  • SPF Checker

    Runs on server
    • Added another email service? Check whether your sender rules still fit.
    • Seeing "SPF PermError: too many DNS lookups"? Count them.
    • Not sure who may send as you? Walk the full include tree.
    • Over the limit of 10? Plan which includes to flatten.
    • Includes that resolve to nothing? Find void lookups.

    Count SPF lookups against the limit of 10, see the include tree and plan flattening.

    • Work out how your domain asks receivers to handle mail that fails authentication.
    • Still on p=none? Build the next step toward reject.
    • No aggregate reports arriving? Check where rua sends them.
    • SPF passes but DMARC fails? Check alignment with the From domain.
    • Mailbox providers require DMARC? Confirm your record is valid.

    Check a DMARC record and build the next one on the way from p=none to p=reject.

  • DKIM Record Checker

    Runs on server
    • Check the public signing key your email provider asked you to publish.
    • Still on a 1024-bit key? Measure its real length from the bytes.
    • Do not know the selector? Try the ones common providers use.
    • Signatures failing after a rotation? Spot revoked or empty keys.
    • Left a key in testing mode? See whether t=y is still set.

    Measure a DKIM key from its bytes, spot testing or revoked keys, find selectors.

    • Check whether your domain tells senders to use encrypted mail delivery.
    • Policy still in testing mode? Check it is ready for enforce.
    • Changed MX hosts? Confirm the policy still covers each one.
    • Policy file not loading? Check the mta-sts host serves it.
    • No TLS failure reports? Check the TLS-RPT record.

    Check the MTA-STS record, policy file and MX coverage, plus TLS-RPT reporting.

  • BIMI Record Checker

    Runs on server
    • Trying to get your logo into inboxes? Check the published requirements.
    • Logo not showing? Check the SVG against the Tiny PS profile.
    • See how your logo will look as an inbox avatar.
    • Bought a VMC or CMC? Check the certificate your record names.
    • DMARC not enforced yet? See why BIMI is still blocked.

    Preview a BIMI logo in an inbox and check the SVG Tiny PS profile, certificate and DMARC.

  • Email Header Analyzer

    Runs in browser
    • A message arrived late or failed authentication. Follow its trail.
    • Message arrived late? Find the hop where it waited.
    • Suspect phishing? Compare From, Reply-To and Return-Path.
    • Forwarded mail failing DMARC? See which result broke alignment.
    • Have an .eml file? Drop it in and read the route hop by hop.

    Trace each hop and its delay, and read SPF, DKIM and DMARC results and alignment.