# Email Authentication Checker

URL: https://phishdestroy.io/developer-tools/email-auth-checker
Category: Email
Where it runs: Network: DoH

Enter a domain to see how well it is protected against spoofing: the SPF include tree with its lookup count, the DMARC policy, DKIM key sizes, MTA-STS, TLS-RPT, BIMI and MX.

DNS names you look up are sent to the PhishDestroy DNS relay (/api/dns-resolve.php), which asks Cloudflare or Google DNS over HTTPS.

## Example input

A domain that sends no mail

```
example.com
```

SPF v=spf1 -all, DMARC p=reject and a null MX (0 .): the domain declares that it neither sends nor receives mail, so any message from it is forged.

## FAQ

### What does the Email Authentication Checker look up?

The SPF record and every include and redirect it pulls in, counting DNS-querying terms against the limit of 10 and void lookups against 2 (RFC 7208). It also reads the DMARC record, falling back to the organizational domain, DKIM keys for the selectors you give, and the MTA-STS, TLS-RPT, BIMI and MX records.

### What can the checker not see?

DNS cannot list DKIM keys: each sits under a selector chosen by the sender, so enter the s= value from a message's DKIM-Signature header or try the common selectors; a miss proves nothing. The MTA-STS policy file and the BIMI logo are not downloaded, and SPF macros that depend on the sender are not expanded.

### What is sent over the network?

Only DNS names built from the domain you enter, such as _dmarc.example.com, go to the PhishDestroy DNS relay, which asks Cloudflare or Google over DNS over HTTPS. A check uses about 5 to 25 queries; the relay allows 60 per minute.

## Related tools

- [EML Analyzer](https://phishdestroy.io/developer-tools/eml-analyzer)
- [Email Header Parser](https://phishdestroy.io/developer-tools/email-header-parser)
- [DNS over HTTPS Lookup](https://phishdestroy.io/developer-tools/dns-over-https-lookup)
- [Lookalike Domain Generator](https://phishdestroy.io/developer-tools/lookalike-generator)
- [Abuse Contact Lookup](https://phishdestroy.io/developer-tools/abuse-contact-lookup)

All tools: https://phishdestroy.io/developer-tools