Free DMARC, SPF and MX checker
Find out whether a domain can be used to send fake email, what's misconfigured, and exactly what to change. Every result links back to the live DNS record it came from.
What the email security test checks
- DMARC
- Policy, subdomain policy, alignment and report addresses, including whether outside report destinations have authorised them.
- SPF
- The full include chain, every DNS lookup counted against the limit of 10, void lookups, loops and syntax errors.
- Mail servers
- MX records, their priority, and whether every server resolves to a public address. Null MX and implicit MX are handled.
- ASD ISM
- How the domain measures up against the Australian ISM email controls for SPF hard fail and DMARC reject.
- Resolvers
- Google and Cloudflare are asked separately, so stale caches and inconsistent nameservers show up.
Questions
Is this email security check free?
Yes. There is no account, no limit on domains, and nothing to install. Each address can run 30 checks a minute.
What does the score mean?
Every domain starts at 100 and loses points for each problem: 40 for critical, 25 for high, 12 for medium and 4 for low. 90 or more is an A. The report lists every deduction and the DNS record behind it.
Does the check send email to my domain?
No. It only reads public DNS records through Google and Cloudflare. Nothing is sent to your mail servers, and MailTwin does not save the domains you check.
Why is DKIM not checked?
DKIM keys sit under a selector name chosen by each sending service (for example google._domainkey), and DNS cannot list them. You can look up a known selector with the DNS lookup.
Which DMARC policy should I use?
Start with p=none and a reporting address, fix every legitimate sender, then move to p=quarantine and finally p=reject. The rollout guide walks through each step.