# Email authentication tools

Investigate public mail routing and authentication records before changing DNS.

Canonical: https://tamperbox.dev/categories/email

Updated: 2026-10-29

Reviewed: 2026-10-26

Investigate public mail routing and authentication records before changing DNS. MX, SPF, DKIM and DMARC answer different questions; publishing valid records does not prove that a message will arrive or pass authentication.

## Choose a check

Start with MX and provider lookup for inbound routing. For outgoing authentication, inspect SPF includes, the DKIM selector from a sent message and the DMARC policy. Compare these records with headers from a message received by a system you trust. MTA-STS and BIMI cover separate transport and logo-publication tasks.

## Tools in this collection

- [MX Lookup & Email Domain Checker](https://tamperbox.dev/email-domain): **Check where a domain receives mail before changing its setup.**

  Check MX, null MX and address fallback with live DNS evidence.
- [Email Provider Lookup](https://tamperbox.dev/email-provider): **Taking over a domain? Find out who handles its email.**

  Identify email hosts and gateways from MX records, with matching evidence.
- [SPF Checker](https://tamperbox.dev/spf-checker): **Added another email service? Check whether your sender rules still fit.**

  Count SPF lookups against the limit of 10, see the include tree and plan flattening.
- [DMARC Checker & Generator](https://tamperbox.dev/dmarc-checker): **Work out how your domain asks receivers to handle mail that fails authentication.**

  Check a DMARC record and build the next one on the way from p=none to p=reject.
- [DKIM Record Checker](https://tamperbox.dev/dkim-checker): **Check the public signing key your email provider asked you to publish.**

  Measure a DKIM key from its bytes, spot testing or revoked keys, find selectors.
- [MTA-STS & TLS-RPT Checker](https://tamperbox.dev/mta-sts-checker): **Check whether your domain tells senders to use encrypted mail delivery.**

  Check the MTA-STS record, policy file and MX coverage, plus TLS-RPT reporting.
- [BIMI Record Checker](https://tamperbox.dev/bimi-checker): **Trying to get your logo into inboxes? Check the published requirements.**

  Preview a BIMI logo in an inbox and check the SVG Tiny PS profile, certificate and DMARC.
- [Email Header Analyzer](https://tamperbox.dev/email-header-analyzer): **A message arrived late or failed authentication. Follow its trail.**

  Trace each hop and its delay, and read SPF, DKIM and DMARC results and alignment.

## Continue exploring

[API & HTTP tools](https://tamperbox.dev/categories/api) · [Domains, registration & hosting tools](https://tamperbox.dev/categories/domains) · [DNS tools](https://tamperbox.dev/categories/dns) · [Network & IP tools](https://tamperbox.dev/categories/network) · [Crawl, SEO & site checks](https://tamperbox.dev/categories/web) · [Web security & TLS tools](https://tamperbox.dev/categories/security) · [Data format tools](https://tamperbox.dev/categories/data) · [Text & test data tools](https://tamperbox.dev/categories/text-testdata) · [Localization tools](https://tamperbox.dev/categories/localization) · [UI testing tools](https://tamperbox.dev/categories/ui-testing)