Scanaris
Scan for free
← All checks
EmailTypical severity: Medium

Email Authentication Scanner

Checks the domain's SPF, DKIM, DMARC, MX, BIMI and MTA-STS records to prevent email spoofing.

What it checks

This scanner queries your domain's email authentication records: SPF, DMARC, BIMI and MTA-STS. It checks whether they are present and correctly configured to verify that only authorized servers can send email on your behalf.

Why it matters

Without proper SPF and DMARC, anyone can send emails that appear to come from your domain, a tactic widely used in phishing and fraud. That damages your customers' trust and makes your legitimate emails land in spam more often.

How to fix it

Publish an SPF record in your DNS listing your sending servers and a DMARC record with a policy that rejects or quarantines unauthorized mail. Start with a soft policy to observe traffic and tighten it as you confirm everything works.

How this check works

This check does not touch your website: it queries your domain's DNS. And it climbs the domain chain (if you scan app.yourdomain.com, it also looks at yourdomain.com), because email is configured on the registrable domain. It looks for five things. SPF: a TXT record starting with v=spf1; if there is none at any level, medium severity; if it ends in +all, high; if there is more than one, medium. DMARC: a TXT at _dmarc. with v=DMARC1; missing, medium; present with p=none, low. BIMI: only if you already have DMARC, and its absence is informational. If SPF or DMARC exists (a sign the domain uses email), it also checks the MX records (missing, low) and DKIM, trying fourteen common selectors (google, default, selector1, selector2, k1, s1, dkim, mail, mandrill, zoho…); if none answers, low, with the caveat that you may use a different selector. Finally, MTA-STS at _mta-sts.; missing, low. If any DNS query fails, the finding is not invented.

Why it matters

Without SPF or DMARC, anyone can send emails claiming to come from support@yourdomain.com and receiving servers have no way to know they are fake. That is the basis of phishing with your brand: against your customers, your suppliers or your own team. On top of that, since 2024 Gmail and Yahoo require SPF, DKIM and DMARC from anyone sending at volume; without them your legitimate email goes to spam or is rejected. DKIM signs each message so it cannot be altered in transit. MTA-STS prevents an attacker on the network from forcing your mail to be delivered unencrypted. And BIMI, once all of the above is in place, puts your logo next to your emails in Gmail and Apple Mail.

How to fix it

SPF

v=spf1 include:_spf.google.com ~all

A single TXT record on the domain, with one include: per service that sends email on your behalf (Google Workspace, Microsoft 365 with spf.protection.outlook.com, your transactional provider). End with ~all or -all, never +all. If you have two records, merge them into one. Ten DNS lookups at most in total; beyond that, SPF stops validating.

DKIM

You enable it at the email provider (Google Workspace, Microsoft 365, Resend, SendGrid…), which gives you a TXT or CNAME record to publish at selector._domainkey.yourdomain.com. To find out which selector you use, open an email sent from your domain, look at the headers and find DKIM-Signature: ... s=selector.

DMARC

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

At _dmarc.yourdomain.com. Start at p=none to receive reports without blocking anything, review for two or three weeks which services send on your behalf, add them to SPF and DKIM, then move to p=quarantine and later p=reject.

MTA-STS and BIMI

MTA-STS is two pieces: a TXT at _mta-sts.yourdomain.com with v=STSv1; id=2026100901 and a file at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt with mode: enforce, your MX servers and a max_age. BIMI requires DMARC at quarantine or reject, a square SVG logo and a TXT at default._bimi; Gmail additionally requires a Verified Mark Certificate (VMC), which is paid.

Check it is fixed

dig +short TXT yourdomain.com | grep spf1
dig +short TXT _dmarc.yourdomain.com
dig +short MX yourdomain.com
dig +short TXT google._domainkey.yourdomain.com
dig +short TXT _mta-sts.yourdomain.com

Replace google with your selector. On Windows, nslookup -type=TXT _dmarc.yourdomain.com does the same. DNS changes take from minutes to a few hours to show.

Frequently asked questions

My domain does not send email. Do I need all this?

You still need SPF and DMARC, but in the "nobody sends" version: v=spf1 -all and v=DMARC1; p=reject. That way nobody can impersonate you. MX, DKIM and the rest will not be asked of you because they are only checked when the domain uses email.

I have DKIM but it says "no DKIM on common selectors".

You use a selector that is not on the list. The finding says so, and it is low severity precisely for that reason. Check it with the command above and your real selector, and mark it as accepted.

Is DMARC at p=none useless?

It is useful to see who sends on your behalf, which is the essential first step. But it blocks nothing: a fake email with DMARC at p=none still gets through. Protection starts at quarantine. The rest of the domain's health (CAA, DNSSEC, expiry) is covered by domain health.

Check it on your site

Scan your site free and see if this and 44 other checks pass, with a fix prompt for every issue.

Scan my site free