Parse a .eml file: headers, Received chain, links, attachment hashes, sender mismatches.
New
Email Authentication Checker
Network: DoHNew
Use Email Authentication Checker
What it does
Enter a domain to see how well it is protected against spoofing: the SPF include tree with its lookup count, the DMARC policy, DKIM key sizes, MTA-STS, TLS-RPT, BIMI and MX.
DNS names you look up are sent to the PhishDestroy DNS relay (/api/dns-resolve.php), which asks Cloudflare or Google DNS over HTTPS.
Example
A domain that sends no mail
example.comChecked example[.]com · 6 DNS queries through the relay (Cloudflare)
Summary
RECORD STATUS FINDING
SPF pass "v=spf1 -all": no server may send mail as example[.]com, so any message from it is forged
DMARC warn p=reject, sp=reject
DKIM info Not checked: DKIM keys can only be found by selector (see the DKIM-Signature s= of a message)
MTA-STS info No MTA-STS record (optional): senders may deliver over unencrypted or unverified TLS
TLS-RPT info No TLS-RPT record (optional): no reports about TLS delivery failures
BIMI info No BIMI record (optional). DMARC is at enforcement
MX info Null MX "0 .": the domain accepts no mail (RFC 7505)
SPF
DNS-QUERYING TERMS
0 of 10
VOID LOOKUPS
0 of 2
UNLISTED SENDERS GET
fail (-all)
v=spf1 -all
Include and redirect tree (lookups are numbered in evaluation order; include, a, mx, ptr, exists and redirect count, RFC 7208 §4.6.4)
example[.]com · 0 lookups here, 0 in this branch
fail -all
DMARC
Found at _dmarc.example[.]com
v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s
warn no rua: the owner receives no aggregate reports
TAG VALUE MEANING
v DMARC1 version
p reject policy for the domain itself — reject: failing mail is refused
sp reject policy for subdomains (default: p) — reject: failing mail is refused
adkim s DKIM alignment: r = same organization, s = exact domain (default r)
aspf s SPF alignment: r = same organization, s = exact domain (default r)
DKIM
DNS cannot list DKIM keys: each one sits under a selector chosen by the sender (selector._domainkey.example[.]com). Enter the s= value from a message's DKIM-Signature header, or press “Try common
…SPF v=spf1 -all, DMARC p=reject and a null MX (0 .): the domain declares that it neither sends nor receives mail, so any message from it is forged.
FAQ
What does the Email Authentication Checker look up?
The SPF record and every include and redirect it pulls in, counting DNS-querying terms against the limit of 10 and void lookups against 2 (RFC 7208). It also reads the DMARC record, falling back to the organizational domain, DKIM keys for the selectors you give, and the MTA-STS, TLS-RPT, BIMI and MX records.
What can the checker not see?
DNS cannot list DKIM keys: each sits under a selector chosen by the sender, so enter the s= value from a message's DKIM-Signature header or try the common selectors; a miss proves nothing. The MTA-STS policy file and the BIMI logo are not downloaded, and SPF macros that depend on the sender are not expanded.
What is sent over the network?
Only DNS names built from the domain you enter, such as _dmarc.example.com, go to the PhishDestroy DNS relay, which asks Cloudflare or Google over DNS over HTTPS. A check uses about 5 to 25 queries; the relay allows 60 per minute.