Domain Security Guide
Get Your Domain Security Letter Grade in Seconds
Every business domain has an attack surface that any auditor or attacker can probe in seconds. We check the same records they do — SPF, DKIM, DMARC, MTA-STS, DNSSEC, breach exposure, and web security headers — and assign an A–F grade with the specific gaps to fix.
- Instant result
- No account needed
- SPF · DKIM · DMARC · MTA-STS · DNSSEC
DNS record checks for yourcompany.com
Passed: SPF
v=spf1 … -all
Passed: DKIM
selector1, selector2
Passed: DMARC
p=reject
Passed: MTA-STS
mode=enforce
Passed: DNSSEC
DS records present
Reported: Breach exposure
0 leaked credentials
Domain score
A
Strong, 92 of 100
We pull the same authoritative DNS records that receiving mail servers and security scanners use, then translate them into an A–F grade you can show leadership.
95%
Of phishing attacks rely on impersonating a legitimate domain
6 checks
Authentication and exposure records evaluated
30 sec
Average time from input to letter grade
What Gets Checked
Each record below is fetched live from authoritative DNS or breach intelligence sources. The grade reflects real receiver and attacker behavior — not a checklist.
SPF
- Authorized sender IP list present
- No softfail on production senders
- Length within DNS lookup limits
DKIM
- Signing selectors discoverable
- Key length ≥ 1024 bits
- All sending services covered
DMARC
- Policy at quarantine or reject
- Aggregate reporting (rua) configured
- Subdomain policy applied
MTA-STS
- Policy file served over HTTPS
- Mode set to enforce, not testing
- Policy ID rotation tracked
DNSSEC
- DS records published at parent
- Signing keys not expired
- Validates against trust chain
Breach exposure
- Cross-references known breach corpora
- Identifies exposed employee credentials
- Flags high-risk reuse patterns
Key insight
Most domain security failures aren't configuration errors — they're drift. A domain that earned an A two years ago picks up new sending services, expired DKIM selectors, and forgotten subdomains. The attacker only has to find the one record that wasn't maintained. Grade your domain on the same cadence you grade your tenant.
How it works
From input to letter grade in 30 seconds
Enter your domain
Just the domain — no signup
Live DNS lookups
Authoritative records pulled in parallel
Scored against best practice
Receiver and attacker behavior
Specific fixes
Per-record remediation steps
Check Your Domain Now
Free Domain Security Score grades your domain against SPF, DKIM, DMARC, MTA-STS, DNSSEC, breach exposure, and web security headers. No account required.
Check My Domain Score (Free)