Free · no signup
Is your domain configured to be trusted?
Thirty checks across DNS, email authentication and mail transport. You get the raw records, what each one means, and how to fix anything that is wrong — whether or not you ever become a customer.
Reads public DNS only ·
What the scanner checks
The scan runs entirely from outside. It asks your nameservers the same questions a resolver would, fetches the same policy files a sending mail server would, and reports what came back. Nothing needs access to your account, your registrar or your DNS provider.
DNS health
Whether the NS records at your parent zone match the ones inside the zone — two separate record sets that nothing forces to agree, and a common source of nameservers you thought you had retired still answering for part of the internet. Whether every delegated nameserver actually answers authoritatively, and whether they all serve the same SOA serial, which is how you catch a secondary that stopped receiving transfers. DNSSEC is checked end to end: a DS at the parent, a DNSKEY in the zone, and whether the digests actually match — a DS pointing at a key that is not there takes the domain offline for every validating resolver, which is worse than being unsigned. We also try a zone transfer against each nameserver, and look for a CAA record.
Email authentication
Your SPF record is expanded recursively and every include, a, mx and exists term counted against the 10-lookup limit in RFC 7208 §4.6.4, with the count attributed to the includes that caused it. We check the terminal mechanism, because a record ending in +all authorises the entire internet. DMARC is read for policy, subdomain policy, percentage and reporting — including the external destination authorisation in RFC 7489 §7.1, whose absence makes DMARC look configured while silently producing no reports at all. Subdomains are credited with the organisational policy they inherit.
DKIM is the honest exception. DNS has no operation that lists what exists under a name, so no tool can enumerate your selectors. We probe the ones the major providers use and tell you what we found; a miss is reported as not checked, never as a failure.
Transport security
MX records and whether their targets resolve, whether your mail servers offer STARTTLS, and your MTA-STS policy — fetched from the live policy host and compared against the MX records actually published. A policy that has fallen behind an MX change does not degrade delivery for senders that honour it; it stops it. TLS-RPT and BIMI round the category out, with BIMI assessed only once DMARC is at enforcement, because it does nothing before then.
Look-alike domains
We generate the most productive typo and keyword variants of your domain and check which already resolve or accept mail. This category is reported but deliberately not scored: DNS cannot tell us who owns a domain, and a well-run brand often owns many of its own look-alikes defensively. Counting those against you would be penalising you for doing the right thing.
How the score works
Each check is worth a fixed number of points within its category, categories are weighted, and a check that does not apply is excluded from the denominator rather than scored zero — a domain with no MX does not receive mail, so grading it on inbound transport would be meaningless. A check we could not complete is also excluded, and shown as not checked. It is never quietly counted as a pass. The full model, check by check, is published.
Frequently asked questions
Do I need an account?+
No. There is no signup, no email gate, and no part of the result held back. The scan reads public DNS and public policy files, which is information anyone can look up.
Do you store the domains people scan?+
Not in a readable form. Results are cached for fifteen minutes so a repeat check is instant, and our analytics record a truncated hash of the domain so we can count distinct domains and repeat scans. We do not keep a list of who checked what.
Why can you not find my DKIM key?+
DNS has no operation that lists what exists under a name, so there is no way for any tool to enumerate your selectors. We probe the selectors the major providers use. If yours is custom, we will not find it — which is why a miss is reported as not checked rather than as a failure.
My score went down after I changed nothing. Why?+
Most likely a check that previously timed out completed this time, or one of your providers changed something — a new include in an SPF record you reference, or an MX change that your MTA-STS policy has not caught up with. The findings will say which.
Is a perfect score the goal?+
No. Some checks will never apply to some domains, and that is the correct outcome rather than a gap. Read the categories and the individual findings; the composite is a summary, not a target.
Can I see exactly how the score is calculated?+
Yes. Every check, its point value and its reasoning are published on the methodology page, and that page is generated from the same code that produces the scores, so it cannot drift.