DNS & Email Security Posture
Find out how easily someone could send mail as you. This grades a domain's email posture end to end — its sender authorisation, reporting setup, signing vendors, and mail servers — and flags the gaps that let attackers spoof your brand or that quietly hurt your deliverability. The one-look email-security health check.
How it uses the graph
Traverses the email, DNS layers of the graph, in 12 steps:
Counting the domain’s SPF-authorised senders…
Reading DMARC report recipients…
Reading DKIM signing vendors…
Listing the domain’s mail servers…
Scoring the infrastructure reputation…
MX hygiene (mail servers + resolved IPs)…
Where the mail is hosted (MX → IP → ASN)…
Authoritative nameservers…
SPF include tree (nested, flattened)…
IPs authorized to send mail…
SPF redirect & exists mechanisms…
Shared-sender cluster (co-hosted domains)…
Why each step runs
- 01SPF reach. Sizes the SPF authorisation surface — every sender trusted to mail as the domain.
- 02DMARC reporting. DMARC reporting recipients show whether failures are monitored.
- 03DKIM vendors. DKIM signers name the third parties trusted to sign mail (prod-ahead layer).
- 04Mail servers. The MX set is the mail infrastructure to trust and monitor.
- 05Infrastructure reputation. Reputation of the infrastructure behind the mail posture.
- 06MX hygiene (mail servers + resolved IPs). Lists each mail server and whether it actually resolves to an IP — an MX with no A record is lame delegation and a delivery/hygiene gap.
- 07Where the mail is hosted (MX → IP → ASN). Reveals the network (ASN / provider) that actually hosts the domain's mail, exposing third-party mail providers behind the MX names.
- 08Authoritative nameservers. Shows the authoritative DNS servers for the domain — the delegation that all of its mail, SPF and DMARC records ultimately depend on.
- 09SPF include tree (nested, flattened). Flattens the full nested SPF include chain (up to 3 levels) so every delegated sender domain is visible, not just the top-level includes the anchor counts.
- 10IPs authorized to send mail. Resolves the SPF policy down to the concrete IPs (direct SPF_IP plus those reached through includes) that are permitted to send mail as the domain — the real spoofability surface.
- 11SPF redirect & exists mechanisms. Surfaces the dynamic SPF mechanisms — which other domain owns the policy this domain redirects to, and any exists lookups it depends on — that a plain include count misses.
- 12Shared-sender cluster (co-hosted domains). Pivots from the domain's own mail servers to other domains that share them, enriched with each co-domain's threat verdict — the shared-mail-infrastructure and abuse-concentration signal.