Skip to content
Unsolicited Outreach

Domain report card.

What someone can do with your domain today, read from the public DNS records anyone can look up. Enter yours, or any domain that sent you something.

The part after the @ in an email address. Nothing you enter is stored.

How this works

  • Every answer comes from public DNS, fetched through Cloudflare's resolver. We never connect to the domain's mail or web servers, and we never fetch its MTA-STS policy file.
  • Nothing you enter is stored. The only thing we keep is a hashed count of checks per network, so one person can't run thousands.
  • DKIM selectors can't be listed from outside, so we try 20 names that common providers use. A miss means “not at those names,” not “no DKIM.” If you know your selector, enter it.
  • For a subdomain, DMARC is also checked on the parent domain, the way receivers do it. The parent is guessed from the name, which is right for almost every domain and approximate for a few registries.
  • The grade summarises SPF, DKIM, and DMARC, because those decide whether a stranger can send mail as you. DNSSEC and MTA-STS are reported but don't move the grade.

New to these terms? SPF, DKIM, and DMARC in plain English explains what each one does.