All checks

Email Configuration

MX, SPF, DKIM and DMARC records for sending and receiving mail

What it is

MX records say which servers receive a domain's mail. SPF lists the servers allowed to send it. DKIM publishes a key that receivers use to check a message was signed by the domain and not altered. Web Check looks for it under common selector names, so "Not found" does not prove there is no key. DMARC tells receivers what to do with mail that fails both SPF and DKIM. A policy of none only monitors, so the checklist ticks DMARC once it's set to quarantine or reject. BIMI is an optional logo, and most domains skip it. MTA-STS and DANE tell other mail servers to only deliver to this domain over a verified, encrypted connection, and TLS-RPT asks them to report when they cannot.

Why it matters

Without a DMARC policy of quarantine or reject, anyone can send mail with the domain in the From line. SPF alone doesn't stop this, because it checks a hidden envelope address, not the one people see. Mistakes hurt the domain's own mail too. If there are two SPF records, or one that needs more than 10 DNS lookups, SPF fails for every message. The MX hosts and SPF includes name the mail provider and many of the vendors allowed to send, a quick way to map who an organisation works with.

Key terms

SPF
A DNS record listing the servers allowed to send email for the domain, so receivers can spot forged mail.
DKIM
Signs outgoing email with a key published in DNS, so receivers can check it came from the domain and wasn't changed.
DMARC
Tells receivers what to do with mail that fails SPF and DKIM, and where to send reports about it.
BIMI
Shows a brand's logo next to its emails in supported inboxes, once DMARC is enforced.
MTA-STS
Makes other mail servers use encrypted, verified connections when delivering email to this domain.
TLS-RPT
Asks other mail servers to report when they fail to deliver mail here securely.
DANE
Publishes the mail server's certificate details in signed DNS records, so senders can check it without a certificate authority.

Related checks