Tools

Email security

Review the domain rules that help stop spoofing.

Online lookup

Email security check

Check for free whether scammers can send emails and fake invoices in your domain's name.

What do these checks mean?

DNS is your domain’s address book. You usually edit it with your domain seller or DNS host; your email provider supplies the values. Save a copy of your current settings before changing them.

Start with SPF and DKIM, test real messages, then strengthen DMARC. DNSSEC, MTA-STS and CAA add different protections, not just points. Passing checks does not guarantee that all mail is safe.

SPF

Your list of approved email senders. It tells receiving mail services which servers are allowed to send mail for your domain.

How to set it up

  1. List every service that sends your email: your mailbox provider, newsletters, invoices and contact forms.
  2. Ask your email provider for its SPF settings. In your domain’s DNS settings, update the existing SPF TXT entry; do not add a second SPF entry.
  3. Include all legitimate senders before choosing ~all (soft fail) or -all (fail). Send a test email from each service.

A pass here means one SPF entry with ~all or -all was found. It does not verify every sender or guarantee that spoofed messages are blocked.

DMARC

Instructions for handling mail that cannot prove it belongs to your domain. It connects SPF and DKIM to the domain people see in the From address.

How to set it up

  1. First make sure your real email passes SPF or DKIM and matches your From domain. Your mail provider can help.
  2. Add or update the TXT entry at _dmarc.your-domain using your provider’s instructions. Start with p=none and review reports if you are unsure about your senders.
  3. Once legitimate mail works, move to p=quarantine (ask for suspicious mail to go to spam), then p=reject (ask for it to be refused). Test newsletters, invoices and ordinary mail.

This check passes quarantine or reject policies. p=none is monitoring only; receivers decide how to apply the policy. Do not switch to reject just to raise your score.

DKIM

A digital seal added by your mail provider. Receiving services can check it to see whether a signed message was changed after it was sent.

How to set it up

  1. Open the domain settings at your email provider and find DKIM signing.
  2. Copy its exact DNS entries into your domain’s DNS settings. Providers may give you TXT or CNAME entries; use their names and values, not a guessed key.
  3. For Migadu, use the DKIM names shown in your Migadu domain settings. Send a real email and check its authentication details for dkim=pass.

This tool checks a limited list of common key names. ‘Not found’ is not proof that DKIM is absent; a published key is not proof that outgoing mail is signed. Re-check after saving, and confirm with a real message.

DNSSEC

A seal on your domain’s address-book entries. Services that check it can detect forged DNS answers.

How to set it up

  1. Find who hosts your DNS settings; this may be different from the company where you bought the domain.
  2. Enable DNSSEC at the DNS host. If the registrar asks for a DS entry, copy the exact values supplied by that host.
  3. If one company manages both, it may handle this in one step. Follow its instructions and verify your website and email still work.

Wrong or outdated DS values can make your domain unreachable. Ask your provider to help if you are unsure; do not invent these values.

MTA-STS

A rule asking supporting mail services to use a secure connection when delivering mail to you, and to check your mail server’s identity.

How to set it up

  1. Ask your email provider whether it supports MTA-STS and which mail-server names to use.
  2. Publish its policy file over HTTPS at https://mta-sts.your-domain/.well-known/mta-sts.txt with a valid certificate, plus the _mta-sts TXT entry.
  3. Start in testing mode, review delivery reports, then enable enforcement when the policy and mail servers are correct.

The score checks the public TXT announcement only, not the hosted policy or delivery. A TXT entry alone does not enable protection. This protects incoming transport, not message contents end to end.

CAA

A list of organisations allowed to issue security certificates for your domain. It helps limit who can issue the certificates used by HTTPS websites.

How to set it up

  1. Ask your website and mail-policy hosts which certificate authorities they use, including automatic renewals.
  2. Add CAA entries for those authorities in your domain’s DNS settings, following your host’s instructions.
  3. Include any authority needed for wildcard certificates and check that renewals still work.

CAA is not an email-spoofing block. A wrong entry can prevent new certificates or renewals; the score checks that an entry exists, not that your choices are correct.

MX

The address of the servers that receive your email.

How to set it up

  1. Copy the MX names and priorities supplied by your email provider into your domain’s DNS settings.
  2. Remove old entries only as instructed by the provider, then test that you receive mail.

MX entries point to a mail service; finding them does not prove that delivery works.

TLS-RPT

Delivery problem reports. Supporting mail services can tell you when they could not establish a secure connection to your mail server.

How to set it up

  1. Choose a reporting mailbox or reporting service with your email provider.
  2. Add the provider’s TLS-RPT TXT entry at _smtp._tls.your-domain and review incoming reports, especially when setting up MTA-STS.

Reports help diagnose problems; they do not block unsafe delivery by themselves. They may contain operational information, so choose a trusted recipient.

This is a one-time check of public DNS settings, not continuous monitoring or a search for leaked data. After changes, allow the update time stated by your provider and run the check again. Your domain settings are not changed here.