// tools/email-security

Email security checker

Enter a domain to check its MX, SPF, DKIM, DMARC, MTA-STS and TLS reporting records. You'll get a grade, what each finding means and the record to fix it, with Microsoft 365 specifics where they apply.

Lookups go straight from your browser to Microsoft or a public DNS resolver. Nothing is sent to this site.

DNS is queried over HTTPS through Google Public DNS, falling back to Cloudflare. DKIM is checked at Microsoft 365's selector1 and selector2 plus a few common selectors; other providers may use selectors this tool can't guess. Based on RFC 7208 (SPF), RFC 7489 (DMARC), RFC 7505 (null MX) and Microsoft's email authentication guidance.