Moorfox

SPF, DKIM and DMARC checker

Enter a domain and this tool looks up its email authentication records and grades them: the SPF record and its catch-all policy, the DMARC record and its enforcement level, and (given a selector) the DKIM key. Queries go over DNS-over-HTTPS from your browser; we never see them.

What good looks like

One SPF record ending in ~all or -all; a DMARC record at _dmarc.yourdomain with a policy of quarantine or reject and a rua reporting address; and a DKIM key published for every service that sends as the domain. p=none is where everyone starts (it only reports) and where too many domains stay.

Common DKIM selectors to try: selector1 and selector2 (Microsoft 365), google (Google Workspace), k1 (Mailchimp), s1/s2 (SendGrid).

Mail flows from machines too.

Moorfox keeps an eye on the machines behind the mailboxes: patch age, AV state and disk encryption, scored per device, so the endpoint that undermines your nicely authenticated mail gets noticed.

Request an invite