Example: jamestyler.com
Working, with gaps
1 warning, out of 6 checks.
SPF
- PassA record existsOne record, which is what the specification allows. Two is a failure.
- PassThree senders authorizedEach one is a service that really does send for this domain.
- WarningEight of ten lookups usedSPF stops working entirely at eleven. Adding two more senders breaks it.
DKIM
- PassA key is published2048 bit, which is the size to use. 1024 is still common and still weaker.
DMARC
- PassPolicy is quarantineMail that fails is held rather than delivered. The step after this one is reject.
- PassReports are going somewhereAggregate reports arrive daily, which is how you see a problem before a customer does.
Get told the next time this changes.
You found it today because you went looking. The next one you will not, because nothing announces itself.
This asks me to set it up. It does not start anything and it does not charge you.
I email you about this domain only, when something changes.
This one cannot run in your browser, because it needs real DNS queries. It sends the domain you typed and nothing else. I store the domain to stop the endpoint being used as somebody else’s scanner.
How this is calculated, and what to put in
What these three actually do
- SPF
- Lists which systems may send as your domain. It has a hard limit of ten DNS lookups. Past that the whole record fails rather than degrading, and mail that passed starts failing.
- DKIM
- Signs your mail so a receiver can tell it was not altered. DNS cannot be asked to list your selectors, so this checker tries the common names. Not finding one does not prove you are not signing.
- DMARC
- Tells receivers what to do when the other two fail. It also asks them to report it. Without reports you cannot tell whether a policy is quietly breaking legitimate mail.
Why this one runs on my server
Every other tool here runs in your browser. This one cannot, because a browser is not allowed to make DNS queries.
So it is rate limited, and it stores the domain you checked and nothing else. A checker doing network lookups on request becomes somebody else’s scanner.
What breaks this most often
Nobody breaks authentication deliberately. It breaks when a new tool pushes the record past ten lookups. It breaks when a platform is removed and its entry stays behind.
Neither announces itself. Mail keeps sending and placement quietly softens over weeks. So it is usually found late.