Domain Mail Security Checker

The Domain Mail Security Checker (DMSC) is a centralized diagnostic utility designed to audit and evaluate the email security, authentication, and transport integrity of a domain or list of domains in a single pass. It provides administrators and security teams with the clear, actionable insights needed to harden mail delivery and prevent domain spoofing.

The Audit Problem: Fragmented Checks and Blind Spots

Ensuring reliable email deliverability and protecting a domain from impersonation requires verifying multiple independent security controls: SPF, DKIM, DMARC, MX routing, and transport-layer TLS encryption. Traditionally, auditing a domain meant jumping between several distinct public web utilities or CLI commands—running one tool for SPF syntax, another for DMARC policies, and a third for SSL certificate alignment.

This fragmented approach creates two distinct challenges:

• Friction at Scale: Executing multi-step manual lookups across a client list or during a bulk server migration is extraordinarily time-consuming.
• Hidden Compliance Failures: Generic public lookup tools often verify that a record exists, but fail to catch strict RFC compliance traps—such as an SPF record exceeding the 10 DNS lookup limit (permerror), or an MX server presenting a TLS certificate that doesn't match its hostname.

What the Utility Audits

DMSC consolidates essential mail security checks into a single diagnostic view, turning raw DNS and server responses into immediate status indicators:

• SPF Health & Hop Limits: Parses the SPF record and calculates total DNS lookup mechanisms (RFC 7208 compliance) to catch lookup-limit errors before they cause deliverability failures.
• DKIM Discovery: Probes common and vendor-specific selectors (Google Workspace, Microsoft 365, Plesk, etc.) to confirm public key publication.
• DMARC Enforcement & Telemetry: Evaluates policy rigor (none, quarantine, reject) and checks for active aggregate (rua) and forensic (ruf) reporting addresses.
• Transport Layer Security (TLS): Tests connectivity on secure mail ports (465 and 587) and inspects the active SSL/TLS certificate to verify validity and hostname alignment.

Efficient Batch Auditing & Clean Export

Where the tool saves the most time is when evaluating multiple domains. When onboarding new clients or reviewing an entire organization's portfolio, DMSC accepts raw, unformatted text lists—including full web URLs or email addresses. It automatically cleans and normalizes the input down to the root apex domain prior to auditing.

Once a batch audit completes, the tool offers one-click exports—allowing administrators to instantly copy formatted plain-text reports or download a combined summary text file for client documentation or ticketing records.

Planned Enhancements

To further improve visibility during large batch audits, future updates will introduce granular, step-by-step diagnostic feedback during execution (such as active indicators for MX resolution, port scanning, and record evaluation) so administrators have continuous status visibility for each domain as it processes.