DNS Security Checker

DNS Security Checker inspects the email-authentication and zone-integrity records that protect a domain from spoofing, phishing, and tampering. It evaluates four key mechanisms: SPF (Sender Policy Framework), which lists the servers authorized to send mail for your domain; DKIM (DomainKeys Identified Mail), which uses cryptographic signatures to prove a message was not altered in transit; DMARC (Domain-based Message Authentication, Reporting and Conformance), which tells receivers how to handle messages that fail SPF or DKIM; and DNSSEC, which signs DNS records so resolvers can detect forged answers.

For SPF the tool reads the TXT record and checks its syntax, mechanism count, and policy qualifier so you know whether unauthorized senders are softly or hard-failed. For DKIM it looks up the public key at the relevant selector to confirm a valid key is published. For DMARC it parses the policy (none, quarantine, or reject) along with reporting addresses, helping you understand how aggressively receivers will act on failures. For DNSSEC it confirms whether the zone is signed and whether a chain of trust exists, which guards against cache poisoning and man-in-the-middle redirection.

Common use cases include hardening a domain before a sending reputation problem arises, diagnosing why legitimate mail lands in spam, preparing for bulk-sender requirements imposed by major mailbox providers, and auditing a newly acquired domain. Security and IT teams also use it to verify that SPF, DKIM, and DMARC are aligned and mutually reinforcing rather than configured in isolation.

A practical recommendation is to deploy DMARC in monitoring mode (p=none) first, review the aggregate reports, then tighten to quarantine and finally reject once you are confident all legitimate sources are covered by SPF and DKIM. Keep your SPF record under the ten-DNS-lookup limit to avoid permerror failures, and consider enabling DNSSEC at your registrar for resolver-level integrity. For the raw record values behind these checks, a standard DNS Lookup can confirm exactly what is published.