Domain & Email Security Checker
One scorecard for a domain’s defences: email, certificates, DNS and disclosure.
Try before you buy.
- Free preview: the grade, the spoofing verdict and each area’s score, with the first checks and fixes of each list (up to 10) and the records to publish hidden.
- Locked until you unlock it: download and copy.
- Unlock: Pro pass, ₹179 for 30 days or ₹79 for 1 week, a one-time payment that never renews. Unlock: Pro pass, $5.99 for 30 days or $2.99 for 1 week, a one-time payment that never renews.
Ways to unlock shows how to get the full result.
Printing this result is locked in the free preview.
Check a domain’s security
Checking…
Security scorecard
Can someone send email as this domain?
Fix these first
CA names from the CCADB CAA identifiers report; DNSSEC algorithm advice from IANA’s DNS Security Algorithm Numbers and DS digest registries. The grade is MySmartCoPilot’s own weighting — see “How the grade works” below.
Locked in the free preview. Opens the ways to unlock this result.
Locked in the free preview. Batch runs unlock with a pass.
Locked in the free preview. Query results unlock with a pass.
About the Domain & Email Security Checker
Enter a domain and get one scorecard for everything it publishes to defend itself: whether someone can send email in its name (SPF, DKIM, DMARC), whether mail to it travels encrypted and verified (MTA-STS, DANE, TLS reporting), which certificate authorities may issue certificates for it (CAA), whether its DNS answers are signed (DNSSEC), and whether security researchers can find out how to report a vulnerability (security.txt). Every line is checked against its standard, graded, and comes with the exact record or file to publish when something is missing.
The page starts with the question most people have — can this domain be spoofed? — and then goes area by area, with the most important fixes first. Most lines link to the detailed checker for that record. DNS is read from your browser over DNS-over-HTTPS; only the MTA-STS policy file and security.txt, which browsers cannot read from another site, are fetched by MySmartCoPilot’s server. For a mail-only report with the Google and Yahoo sender rules and reverse DNS, use the Email Domain Health Check.
Without a pass you see a free preview: the grade, the spoofing verdict and each area’s score, with the first checks of each area and the first fixes (an area with one check shows its verdict, not its findings), and where each record goes but not what it says. The full scorecard, the records to publish, copying and the report downloads unlock with a Pro pass.
How to use it
- Enter the domain —
example.com, an e-mail address or a web address all work — and press Check security. The checks take a few seconds. - Read the grade and the spoofing verdict at the top, then Fix these first: critical problems (your domain, mail or certificates can fail, or anyone can send as you) come before important and recommended ones.
- Jump to an area from the index under the verdict, or scroll on: each check explains what it found. Records shows exactly what was read from DNS; with a pass, or after unlocking this result, use Copy next to a suggested record to paste it into your DNS host.
- If DKIM shows no key, open More options and enter your selector (the
s=value in the DKIM-Signature header of a message you sent), then check again. - With a pass, or after unlocking this result, use Copy report, or download it as text, CSV or JSON, to share it or to compare before and after a change.
Examples
Strong: grade A, 100 out of 100 DMARC p=reject · DANE on every mail server · CAA letsencrypt.org · DNSSEC (ECDSA P-256) · security.txt with Contact and Expires
Every area is complete, so there is nothing to fix. A high grade is about what the domain publishes; it does not test the web server or the mail servers themselves.
Poor: grade F, 25 out of 100 Email forged in the name of example.com is still delivered (p=none) Important: Move DMARC from p=none to p=quarantine, then p=reject… Recommended: MTA-STS, TLS-RPT, CAA, DNSSEC, security.txt
SPF and DKIM work, but DMARC only monitors, and none of the other defences is published. Each one is a record or a small file.
MX 0 . · v=spf1 -all · v=DMARC1; p=reject; · CAA 0 issue ";"
Receives no mail (null MX) · spoofing protection 35 of 35 · no CA may issue certificates
Mail delivery checks do not apply, and a CAA record with an empty issuer stops every CA from issuing for the name.
Critical: Repair DNSSEC (re-sign the zone or update the DS record at the registrar) DNSSEC validation fails for example.com (DNSKEY missing)
The DS record at the registrar no longer matches the zone’s keys, so validating resolvers answer SERVFAIL for the whole domain — its website and its mail included.
Common uses
- Auditing your own domain, or a client’s, before a security review or a penetration test.
- Checking whether a domain can be used to send phishing in your name, and what stops it.
- Locking down parked and unused domains: null MX, SPF -all, DMARC p=reject and a CAA record that allows no CA.
- Verifying a change — a new DMARC policy, a CAA record, a DNSSEC rollover — right after you publish it.
What each area checks
- Email spoofing protection: SPF (RFC 7208) lists the servers that may send as the domain; DKIM (RFC 6376) signs messages with a key published in DNS (at least 1024 bits, 2048 recommended, RFC 8301); DMARC (RFC 9989, which replaced RFC 7489) tells receivers what to do with mail that fails both — including the subdomain policy
sp=. - Mail delivery security: the mail servers (MX, RFC 5321; a null MX says the domain takes no mail, RFC 7505), MTA-STS (RFC 8461) and DANE (RFC 7672) — two ways to make sending servers use verified TLS — and TLS reporting (RFC 8460).
- Certificate issuance: CAA (RFC 8659) records at the domain or the closest parent that has some, with the CA behind each identifier from the CCADB list and the account and method limits of RFC 8657.
- DNS integrity: DNSSEC (RFC 4033–4035): the DS records at the parent, the zone’s keys, whether the resolver validated the answers, whether each DS digest matches a key, and whether the algorithms are still allowed in IANA’s registry (RFC 9905 retired RSA/SHA-1).
- Vulnerability disclosure: security.txt (RFC 9116) at
/.well-known/security.txt: a Contact, exactly one Expires date, the content type, the Canonical address and an optional OpenPGP signature. - Brand indicators: BIMI (an Internet-Draft, not a standard yet) is shown but not scored.
How the grade works
The grade is MySmartCoPilot’s own weighting of what can be checked from outside — there is no official security score for domains. The areas share 100 points: email spoofing protection 45 (DMARC 25, SPF 10, DKIM 10), mail delivery security 20 (MTA-STS or DANE 15, TLS reporting 5), certificate issuance 10, DNSSEC 15 and security.txt 10. Partial set-ups earn part of the points — DMARC p=none 6, p=quarantine 18, p=reject 25, minus points for sp=none or pct below 100; a policy in testing mode (t=y) counts one level lower, as receivers apply it. Parts that do not apply (mail delivery checks for a domain with a null MX or without MX records) or could not be checked are left out, and the score is the share of the remaining points. A DKIM key that is not found under the common selector names is left out too, because it may exist under another name. Grades: A 90 and up, B 80, C 65, D 50, F below 50.
MTA-STS or DANE?
Both stop an attacker from quietly downgrading mail to your domain to an unencrypted or unverified connection. MTA-STS publishes a policy file over HTTPS and relies on the mail servers’ CA certificates; DANE pins the certificates in DNS and needs DNSSEC on each mail server’s zone. Sending servers that support both must not let MTA-STS override a failing DANE check (RFC 8461 §2). Either one earns the 15 points here. If a provider hosts your mail, DANE depends on its servers and their zones being signed, while MTA-STS needs only a TXT record and a policy file on your own domain.
Limitations
- Everything is read from DNS and two public files: the scorecard cannot see whether your mail servers offer STARTTLS, which certificate your website uses (the SSL Certificate Checker shows that) or which security headers it sends (see the Security Headers Checker).
- DKIM keys can only be found where the selector is known: common selectors are tried; enter yours under More options.
- DNSSEC is judged by the validating resolver’s answer, Extended DNS Errors and a recomputation of each DS digest; individual signatures are not verified in your browser.
- DANE is checked for the first five mail servers, and the OpenPGP signature of a signed security.txt is detected but not verified.
- security.txt applies only to the exact domain it is fetched from (RFC 9116 §3.1), so subdomains need their own files.
- The resolver sees the names that are looked up, like any DNS lookup, and MySmartCoPilot’s server allows a limited number of file checks per hour for each visitor.
Privacy
Sends data online, including to MySmartCoPilot’s server
The domain you enter, and the optional DKIM selector, are looked up from your browser through a public DNS-over-HTTPS resolver (a second one if the first cannot be reached), which sees your IP address and the names asked for. MySmartCoPilot’s server receives the domain only to fetch its MTA-STS policy file (when it has an MTA-STS record) and its security.txt; it stores nothing. The report stays in your browser.
Frequently asked questions
What do I get without a pass?
Without a pass, Domain & Email Security Checker shows the grade, the spoofing verdict and each area’s score, with the first checks and fixes of each list (up to 10) and the records to publish hidden. Until you unlock it, the result can’t be downloaded or copied. A Pro, Premium or Ultimate pass, a one-time payment that never renews, unlocks the full result. The pricing page lists the passes and their prices.
Why does my domain get a low grade although its email works?
Email can work while the domain is easy to impersonate or its mail can be downgraded to unencrypted delivery. The grade measures those defences — DMARC enforcement, MTA-STS or DANE, CAA, DNSSEC and security.txt — not whether mail arrives. Start with the critical and important fixes; each one is usually a single DNS record.
Can someone send email that looks like it comes from my domain?
If DMARC is missing or at p=none, receivers have no instruction to stop forged mail, so it reaches inboxes unless spam filters catch it. With p=quarantine it goes to spam; with p=reject receivers that enforce DMARC refuse it. Check sp= too: with sp=none, mail forged from subdomains is still delivered.
Do I need a CAA record?
It is optional, but without one every publicly trusted certificate authority may issue a certificate for your domain. A CAA record such as 0 issue "letsencrypt.org" limits that to the CAs you use. Use the identifier your CA documents — a typo blocks every CA — and add one issue record per CA.
What does a security.txt file need?
At least one Contact (a mailto:, tel: or https: address) and exactly one Expires date in RFC 3339 form, less than a year ahead. Serve it at /.well-known/security.txt as text/plain; charset=utf-8. Canonical, Policy, Encryption and Preferred-Languages are optional, and signing the file with OpenPGP is recommended.
My DNSSEC result says “bogus”. What happened?
The zone is signed, but validation fails — most often the DS record at your registrar no longer matches the zone’s key after a key change, or the signatures expired. Validating resolvers then answer SERVFAIL for the whole domain. Re-sign the zone at your DNS host or put the current DS record at your registrar.
Is the domain I check sent to MySmartCoPilot?
Only so that the server can fetch the two files browsers cannot read: the MTA-STS policy (when the domain has an MTA-STS record) and security.txt. Nothing is stored. All other lookups go from your browser to a public DNS resolver.