Is your domain’s mail authenticated and reported on?
SPF, DKIM, DMARC, MX and DNSSEC — graded on presence and hygiene, never on enforcement strength.
No credit card needed.
What it solves
A domain that sends mail without SPF, DKIM or DMARC configured is trivially spoofable, and a domain that signs mail with DKIM but never set up DMARC reporting has no way to find out when someone else does. Checking all four controls by hand means separately dumping SPF mechanisms, DKIM signers, DMARC recipients and MX records and cross-referencing them — and RFC 7208’s ten-DNS-lookup SPF limit is easy to blow past without noticing.
It reads each control off the graph in turn: the mail-exchange hosts and the network that carries them, every SPF mechanism and the include chain it resolves to, who signs mail with DKIM, and who receives DMARC aggregate reports. Each control is graded on whether it is configured and free of an obvious hygiene issue — an SPF chain over the ten-lookup limit, an SPF_IP authorization wider than a /16, a DKIM signer with no matching SPF authorization, or mail addressed on a threat-listed IP. It never grades enforcement strength: SPF’s -all qualifier and DMARC’s p= policy tag are not yet imported into the graph.
Checking all four controls by hand means four separate DNS lookups and manually walking the SPF include chain to see if it is within the ten-lookup limit.
- dig TXT for SPF
- a DKIM selector lookup
- dig TXT _dmarc
- an MX lookup
What this means
- Give it a domain and it reads its SPF, DKIM, DMARC, MX and DNSSEC records straight off the graph — who can send mail as this domain, who signs it, who gets told when something goes wrong, and who actually receives it.
- It returns a presence-and-hygiene grade for each control, crossing the DNS, email and BGP layers, and flags the gaps that let mail go out unsigned, unreported or over-authorized.
Dig deeper
Read the how-to
What this workflow does and how it uses the graph, plus the copy-paste recipes it's built from.
Open the documentationRelated flows
All use casesAttack-Surface Mapper
See your organisation the way an attacker does. Give it a domain and it maps the full external footprint — every subdomain, the name and mail servers, who registered it, the third-party services it leans on, and the wider web of sites it connects to — and scores the exposure. The starting point for shrinking what's reachable from the outside.
Nameserver & DNS Delegation Audit
Your name servers decide where your domain points — and a broken or inconsistent setup is a hijacking opportunity. This audits a domain's delegation, flags stale or mismatched name servers, sizes how much each provider actually handles, and surfaces registry facts — so you can catch delegation weakness before it's exploited.
Threat Investigation
The deep-dive you run when something looks bad and you need the full story. Give it one indicator and it works outward across its whole footprint — the related domains, the real servers behind any CDN, the neighbouring infrastructure — and checks each piece for known abuse. You get one coherent read on how dangerous it is and why, with safe next steps to pivot on. Reach for it when a quick check says 'look closer.'