sysop@hub:~/tools/domain-check$

domain-check

Can someone send mail that looks like it comes from your domain? Enter the domain and get a graded audit from live DNS: SPF, DMARC, DKIM, MTA-STS, TLS reporting, DNSSEC and CAA, each with the record to publish if it is missing. Works for any domain, yours or a supplier's.

what is checked

Record	What it does	What counts against you
SPF	Lists the servers allowed to send for the domain.	Missing, more than one record, +all or ?all, over 10 DNS lookups, includes that resolve to nothing.
DMARC	Ties the visible From address to SPF and DKIM and tells receivers what to do on failure.	Missing, p=none, pct below 100, no report address, subdomains exempted.
DKIM	Signs each message so changes and forgeries are detectable.	Keys shorter than 2048 bits. Absence cannot be proven: selectors can only be guessed.
MTA-STS / TLS-RPT	Forces encrypted delivery to your mail servers and reports failures.	Missing (low weight).
DNSSEC	Signs your DNS answers so they cannot be forged in transit.	Not validated (low weight).
CAA	Limits which certificate authorities may issue for the domain.	Missing (low weight).

The domain you enter is sent to the DNS resolver you choose, in about 40 queries, straight from your browser. Nothing goes to admin_hub. The check reads public DNS only: it cannot see whether your mail is actually signed, whether the MTA-STS policy file is reachable, or how a particular receiver treats your mail. The grade is our weighting, not an industry standard. Test real delivery by sending a message to a mailbox you control and reading its headers.