Test Your Email Security
Send a message from the address you want to check. We analyse how it actually authenticated on arrival and reply with a report.
WHY THIS IS DIFFERENT
Published policy versus observed realityThe other tools here read what your DNS claims. This one reports what a receiving server observed when your mail actually arrived. Those are not the same thing, and the gap between them is where delivery problems live. A domain can publish a flawless SPF record and still fail DMARC because the envelope sender does not align with the From header. A message can carry a valid DKIM signature backed by a 1024-bit key that large receivers are starting to distrust. Neither shows up in a DNS lookup.
What the report covers
Authentication as observed
The SPF, DKIM and DMARC verdicts our server recorded in Authentication-Results, rather than a prediction of what should happen.
Alignment, explained
Whether SPF and DKIM were aligned with your From domain — strict, relaxed or not at all. A passing but unaligned mechanism contributes nothing to DMARC, and this catches more senders than anything else.
DKIM key strength
We fetch the public key your signature points at and report its type and size, plus revoked keys, testing mode, SHA-1 signatures and l= body-length limits.
Transport and path
Every hop the message took, whether TLS was negotiated, the sending IP, and whether its reverse DNS is forward-confirmed — a common cause of outright rejection.
Header hygiene
Missing Message-ID or Date, clock skew, a Reply-To on a different domain, and display names containing a different address to the real one.
Published records too
Your DMARC and SPF records are looked up alongside, so the report shows both what you publish and what arrived — and where they disagree.
GOOD TO KNOW
Before you send- Send from the system you want to test Sending from your laptop's mail client tests your mail provider. If you want to check an application, a marketing platform or a transactional sender, send from there instead — that is the path that matters.
- The reply goes to the envelope sender Not to the address in your From header. The envelope sender is the one SPF authenticates and where bounces go, so replying there means a spoofed From cannot be used to send reports to someone who never asked for one.
-
Automated mail gets no reply
Bounces, mailing list traffic, out-of-office messages and anything marked
Auto-Submittedare analysed but never answered. Two autoresponders talking to each other is a mail loop, and we will not start one. - Your message is read, then discarded We parse the headers to build the report. Keep the body empty if you would rather not send content at all — nothing in the body is used.
Prefer to check without sending mail? Use the DMARC & SPF lookup, DNS records or blacklist check.