Tool
Mail-Security Check
Check how well a domain is protected against email spoofing and spam abuse. This tool queries MX, SPF, DKIM, and DMARC records live via DNS.
What do these terms mean?
MX (Mail Exchange)
MX records define which servers accept email for a domain. Without MX the domain cannot receive mail. MX plays no direct role in spoofing protection but is part of the overall picture of a mail domain.
SPF (Sender Policy Framework)
A TXT record listing which servers may send on behalf of the domain. The receiver checks the delivering IP against this list. The statement at the end decides what happens to everyone else: -all rejects, ~all flags, +all allows everything and renders SPF useless.
DKIM (DomainKeys Identified Mail)
The sending server cryptographically signs each mail; the public key is published in DNS under a selector (e.g. selector1._domainkey.example.com). This lets the receiver verify the mail wasn't altered in transit and really originates from an authorized system.
DMARC (Domain-based Message Authentication, Reporting and Conformance)
DMARC ties SPF and DKIM to the visible sender address and tells the receiver what to do on failure: p=none (monitor only), p=quarantine (spam folder), or p=reject (refuse). Only DMARC turns SPF and DKIM into real protection against forged senders.
MTA-STS (SMTP MTA Strict Transport Security)
SPF, DKIM and DMARC secure who may send - MTA-STS secures the transport path there. SMTP normally encrypts only when the far end offers it, and that offer can be stripped in transit. MTA-STS has two parts that must both be right: a TXT record at _mta-sts.example.com that makes the policy discoverable, and the policy file at https://mta-sts.example.com/.well-known/mta-sts.txt naming the mode, the lifetime and the permitted MX servers. Under enforce mode, sending servers abort delivery rather than hand the mail over unencrypted or to an unexpected server. TLS-RPT (_smtp._tls) complements this by reporting exactly those failures back.