d4 · tools · email security
Can your domain be spoofed? This checks SPF (including the 10-lookup limit, walked recursively), DKIM keys under common selectors, DMARC policy, MX, MTA-STS and TLS-RPT, and explains each result in plain English. Lookups go straight from your browser to public resolvers.
SPF says which servers may send for the domain; DKIM signs messages with a key published in DNS; DMARC ties the two to the visible From: address, tells receivers what to do on failure and sends you reports; MTA-STS protects mail in transit to you against TLS downgrade. DKIM selectors can only be probed by guessing common names, so a clean "none found" is not proof DKIM is absent.