Who can send?
Check your authorised senders, nested includes, and DNS lookup limits. One SPF record should describe your legitimate sending services.
Understand the checkIndependent email authentication checks
Email trust.
Verified.
Can someone send email as your business? Check your domain’s SPF and DMARC. See the gaps, understand the evidence, and know what to fix.
Need help fixing authentication?Start with your domain.
Free check. No account. A clear next step.
Three checks.
One sending identity.
Email authentication works as a system. Understand each part before changing your DNS.
Is the signature valid?
A domain alone cannot prove that a message passed DKIM. Analyse a received-message header locally to inspect the receiver’s authentication results.
Understand the checkDoes the identity align?
DMARC connects authenticated SPF or DKIM to the visible From domain. Check the policy, collect reports, then decide when enforcement is safe.
Understand the checkLess guessing.
Better evidence.
A small, focused toolkit. Free to use, with your domains, headers and reports kept out of MX Audit’s servers.
DMARC
Build a DMARC record.
Set your policy and reporting address. Get the record to review with your administrator.
HEADER
Read a message header.
See what the receiving server found. SPF, DKIM, DMARC and the signing domain, in one view.
REPORTS
Check before you reject.
Open your aggregate reports locally. Find legitimate senders that still fail alignment.
PORTFOLIO
Review a domain portfolio.
Check up to ten domains against live DNS. Compare findings and export a ranked CSV.
A passing DNS check is the beginning. Trust comes from knowing every sender, checking real messages, and making changes with evidence.
Published policy
The domain check reads public DNS. It shows what you publish, including missing records and SPF lookup problems.
It cannot prove how a real message was authenticated.
Check public DNS ↗Close the gap.
Keep mail moving.
Tightening a policy is easy. Knowing that legitimate mail will still authenticate takes care.
Know who sends.
Your mail platform, newsletter, invoicing system and CRM may all send as your domain. Account for each legitimate service.
Verify before enforcing.
Inspect real headers and aggregate reports. Resolve alignment failures before moving to a stricter policy.
Check the change.
Recheck published DNS and a received message after implementation. Authentication is a measurable result, not an inbox-placement guarantee.
Email Authentication Fix Sprint
Found a problem?
Get it untangled.
A scoped review for a business with an active email-authentication problem. Exact changes for your administrator, followed by verification.
USD 99one-time founding price
- One authorised domain
- Up to three legitimate sending services
- Provider-specific changes and one verification
- One correction round
No payment to enquire. Scope confirmed before payment. For businesses outside Switzerland.
A few things to know.
What is free, and what costs USD 99?
All browser tools are free. USD 99 pays for the scoped Email Authentication Fix Sprint: one authorised domain, up to three senders, provider-specific changes, post-change verification and one correction round. Your administrator applies the changes.
Is my domain stored?
No. DNS queries go directly from your browser to Cloudflare. MX Audit receives no domain or scan result. Headers and reports are analysed locally. Contact details are stored only if you submit a service enquiry.
Can this prove that every email is safe?
No. DNS records describe configuration. DKIM verification needs a selector or received-message evidence. DMARC does not prevent lookalike domains, compromised accounts, or every kind of phishing, and does not guarantee inbox placement.
Is this a penetration test?
No. The scanner reads public DNS. It does not access mailboxes, log in to servers, or change records.