How spoofable is your domain?
One scan, one grade. Every protocol that decides whether a stranger can send email as you — SPF, DKIM, DMARC — plus the transport security that decides whether mail to you can be intercepted. Nothing to install, no account, and the full report is yours as a PDF.
What the scan checks
The scan runs the same checks as the individual free tools and reports the same findings — it just runs them together and adds a grade. Each protocol carries a weight; the grade is the share of available points earned.
- DMARC (40 points) — Is there a record, and is it enforcing? p=reject earns full marks, p=none a fraction. Report-destination and syntax problems cost points.
- SPF (25 points) — Is there a record, does it parse, is it within the 10-lookup limit, and does it end in an enforcing -all?
- MTA-STS (15 points) — Is a policy published, can the policy file actually be fetched, and does its mx list still cover the real MX hosts? An enforce-mode mismatch is a delivery outage, and is scored as one.
- TLS-RPT (10 points) — Is anyone reporting SMTP TLS failures back to you? Without it a broken MTA-STS deployment is silent.
- MX (5 points) — Are there MX records, or a deliberate null MX for a domain that sends but never receives?
- DKIM (5 points) — There is no way to discover a domain's selectors, so the scan probes a fixed list the big providers use. A key it finds is checked and scored; a miss is reported as inconclusive and never counted against you.
How the grade works
- A — 90–100. Well configured.
- B — 75–89. Mostly there. Also the ceiling for any domain still at p=none.
- C — 55–74. Partially protected.
- D — 35–54. Weak. Also the ceiling for any domain with no DMARC record at all.
- F — 0–34. Unprotected.
Two ceilings keep the letter honest about the thing that matters
most: a domain with no DMARC record can't score above D, and a
domain at p=none can't score above B — however good the
rest is, mail in its name is still deliverable by anyone.
What the full report adds
The page shows what to fix. The PDF is the version you hand to whoever owns the DNS: every finding with its remediation, the score breakdown, and each record exactly as published (DMARC, SPF, MX, the MTA-STS record and policy file, TLS-RPT, and any DKIM keys the probe found), dated, so you can show what changed. It arrives by email a few minutes after you ask for it.