DataTel

Domain Security Guide

Get Your Domain Security Letter Grade in Seconds

Every business domain has an attack surface that any auditor or attacker can probe in seconds. We check the same records they do — SPF, DKIM, DMARC, MTA-STS, DNSSEC, breach exposure, and web security headers — and assign an A–F grade with the specific gaps to fix.

Check My Domain (Free)
  • Instant result
  • No account needed
  • SPF · DKIM · DMARC · MTA-STS · DNSSEC
DNS RECORD CHECKSyourcompany.comSPFv=spf1 ... -allDKIMselector1, selector2DMARCp=rejectMTA-STSmode=enforceDNSSECDS records presentBreach exposure0 leaked credentialsDOMAIN SCOREASTRONG · 92 / 100

We pull the same authoritative DNS records that receiving mail servers and security scanners use, then translate them into an A–F grade you can show leadership.

0%

Of phishing attacks rely on impersonating a legitimate domain

0 checks

Authentication and exposure records evaluated

0 sec

Average time from input to letter grade

What Gets Checked

Each record below is fetched live from authoritative DNS or breach intelligence sources. The grade reflects real receiver and attacker behavior — not a checklist.

SPF

  • Authorized sender IP list present
  • No softfail on production senders
  • Length within DNS lookup limits

DKIM

  • Signing selectors discoverable
  • Key length ≥ 1024 bits
  • All sending services covered

DMARC

  • Policy at quarantine or reject
  • Aggregate reporting (rua) configured
  • Subdomain policy applied

MTA-STS

  • Policy file served over HTTPS
  • Mode set to enforce, not testing
  • Policy ID rotation tracked

DNSSEC

  • DS records published at parent
  • Signing keys not expired
  • Validates against trust chain

Breach exposure

  • Cross-references known breach corpora
  • Identifies exposed employee credentials
  • Flags high-risk reuse patterns

Key insight

Most domain security failures aren't configuration errors — they're drift. A domain that earned an A two years ago picks up new sending services, expired DKIM selectors, and forgotten subdomains. The attacker only has to find the one record that wasn't maintained. Grade your domain on the same cadence you grade your tenant.

How it works

From input to letter grade in 30 seconds

1

Enter your domain

Just the domain — no signup

2

Live DNS lookups

Authoritative records pulled in parallel

3

Scored against best practice

Receiver and attacker behavior

4

Specific fixes

Per-record remediation steps

Check Your Domain Now

Free Domain Security Score grades your domain against SPF, DKIM, DMARC, MTA-STS, DNSSEC, breach exposure, and web security headers. No account required.

Check My Domain Score (Free)

Frequently Asked Questions