Why analyze email security?
Email remains the primary attack vector for phishing, business email compromise, and social engineering. Properly configured SPF, DKIM, and DMARC records are the first line of defense against email spoofing. This tool performs a comprehensive check of these authentication records and also detects disposable email addresses commonly used for fraud, spam registration, and anonymity.
Key Terminology
- SPF (Sender Policy Framework)
- A DNS TXT record that specifies which mail servers are authorized to send email for a domain. Without SPF, anyone can send emails pretending to be from that domain.
- DKIM (DomainKeys Identified Mail)
- A cryptographic signature added to outgoing emails that proves the message hasn't been tampered with and originated from the claimed domain. This tool checks 8 common DKIM selector names.
- DMARC (Domain-based Message Authentication)
- A policy that tells receiving mail servers what to do when SPF or DKIM checks fail. A policy of "reject" provides the strongest protection; "none" provides no protection at all.
- Disposable Email
- Temporary email services (like Guerrilla Mail, Mailinator, etc.) that provide throwaway addresses. They're commonly used to bypass registration requirements, create fake accounts, and avoid accountability.
📧 Email Security Analyzer — Frequently Asked Questions
What does the email security score measure?
The score evaluates the email domain's authentication configuration (SPF, DKIM, DMARC), checks if it's a disposable/throwaway domain, and queries threat intelligence for any known malicious activity. A score of 90+ (grade A) means all authentication records are properly configured and no threats detected. Lower scores indicate missing protections that make the domain vulnerable to spoofing.
What email security records does this tool check?
The tool checks SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), DMARC (Domain-based Message Authentication), MX records, and BIMI (Brand Indicators for Message Identification). It also identifies the email provider and checks for known domain breaches.
How does email provider detection work?
The tool examines MX records to identify the email infrastructure. For example, MX records pointing to google.com indicate Google Workspace, outlook.com indicates Microsoft 365, and protonmail.ch indicates ProtonMail.