DNS & Email Security Scanner
Browser-local DoH
JSON / Markdown / CSV
Query DNS over HTTPS, inspect email authentication posture, compare domains, and export report-ready evidence for SPF, DKIM, DMARC, BIMI, MTA-STS, TLS-RPT, and DANE.
Quick scan:
No DNS records yet
Enter a domain and run a scan to view DNS answers, status codes, and TTLs.
Assessment Notes
Score context: parked domains are not penalized for mail-only controls, but SPF and DMARC anti-spoofing still apply.
DNS source: lookups use browser-local DNS-over-HTTPS. Resolver disagreement can indicate propagation, caching, or filtering differences.
Evidence: JSON and Markdown exports include DNS answers, score rationale, and remediation-ready findings.
Email Security Notes
- SPF: Keep total DNS lookup mechanisms at or below 10 and avoid permissive
+allor neutral?allpolicies. - DKIM: Active selectors should publish non-empty public keys; 2048-bit RSA keys are the practical baseline for modern deployments.
- DMARC: Use aggregate reports to validate sender alignment, then progress from
p=noneto quarantine and reject.
- MTA-STS / TLS-RPT: Pair inbound TLS enforcement with failure reporting so delivery issues are visible during rollout.
- DANE: TLSA records are useful when DNSSEC operations are mature enough to support SMTP certificate binding safely.
- Evidence: Exported reports include DNS answers, score rationale, control state, and remediation-ready recommendations.