SPF, DKIM and DMARC checker
Enter a domain and this tool looks up its email authentication records and grades them: the SPF record and its catch-all policy, the DMARC record and its enforcement level, and (given a selector) the DKIM key. Queries go over DNS-over-HTTPS from your browser; we never see them.
What good looks like
One SPF record ending in ~all or -all; a
DMARC record at _dmarc.yourdomain with a policy of
quarantine or reject and a rua
reporting address; and a DKIM key published for every service that sends
as the domain. p=none is where everyone starts (it only
reports) and where too many domains stay.
Common DKIM selectors to try: selector1 and
selector2 (Microsoft 365), google (Google
Workspace), k1 (Mailchimp), s1/s2
(SendGrid).
Mail flows from machines too.
Moorfox keeps an eye on the machines behind the mailboxes: patch age, AV state and disk encryption, scored per device, so the endpoint that undermines your nicely authenticated mail gets noticed.