Free Security Tool

DNS Security Analyzer

Grade your SPF, DKIM, DMARC, DNSSEC and CAA records from A to F.

Get the full picture for your domain

Free recon check of your external footprint: headers, TLS, DNS, subdomains and CVE signals. Your report and a PDF summary, sent to your work email on that domain.

Free External Security Check

What is DNS security?

The records that stop your domain being used for email spoofing, phishing, DNS hijacking and unauthorised certificate issuance. SPF, DKIM and DMARC together prove that mail from your domain is legitimate. Without them, anyone can send email that appears to come from you.

What does this tool check?

  • SPF: which servers may send email for your domain.
  • DKIM: a cryptographic signature proving a message is authentic.
  • DMARC: what receivers do with mail that fails SPF or DKIM (none, quarantine, reject).
  • DNSSEC: signed DNS answers that prevent spoofing.
  • CAA: which Certificate Authorities may issue certificates for you.
  • MX and NS: your mail server and nameserver setup.

Frequently asked questions

What is SPF and why does my domain need it?

SPF (Sender Policy Framework) is a DNS TXT record listing the mail servers allowed to send email for your domain. Without it, attackers can spoof email from your domain, leading to phishing and deliverability problems.

What is DMARC and how does it protect email?

DMARC tells receiving mail servers what to do with email that fails SPF or DKIM, from p=none (monitor only) to p=reject (block), and reports who is sending as your domain. Start at p=none, then move to p=quarantine and p=reject once legitimate mail passes.

What is DKIM and how do I set it up?

DKIM (DomainKeys Identified Mail) signs outgoing email so receivers can confirm it came from an authorised server and was not modified. Generate a key pair with your email provider and publish the public key as a TXT record at [selector]._domainkey.yourdomain.com.

What are CAA records?

CAA (Certificate Authority Authorization) records name the Certificate Authorities allowed to issue certificates for your domain, so an unauthorised CA cannot issue one and enable a man-in-the-middle attack.