Is your domain protected against email spoofing?

Enter a domain and AstraVerify checks the four DNS records that decide whether mail from that domain is trusted: MX (where mail is delivered), SPF (which servers may send), DKIM (cryptographic signing) and DMARC (what receivers should do when a message fails). You get a score out of 100, a grade, and specific fixes with the exact records to publish.

Results come straight from public DNS in a few seconds. No sign-up, nothing to install, and you can confirm the DKIM selector your mail service actually uses by sending one email from your domain.

What AstraVerify checks

• MX records 25 pts — Confirms the domain can receive email and identifies the mail provider (Google Workspace, Microsoft 365, and others).
• SPF 25 pts — Verifies a valid v=spf1 record, the servers it authorises, and whether it ends in -all (reject) or ~all (soft fail).
• DKIM 20 pts — Finds published signing keys across common selectors and checks key strength; a live email can confirm the selector in use.
• DMARC 30 pts — Checks the policy (none, quarantine, reject), alignment mode and reporting addresses, which together decide whether spoofed mail is blocked.

How it works

1. Enter a domain. Type any domain, for example example.com. No account needed.
2. Get a score in seconds. MX, SPF and DMARC results appear immediately; DKIM selectors are checked in the background.
3. Fix what matters. Each recommendation explains the risk and gives the exact DNS record to publish.

Guides

• What is SPF? Sender Policy Framework explained
• What is DKIM? DomainKeys Identified Mail explained
• What is DMARC? Policies, alignment and reports explained
• What are MX records? How email routing works
• How the AstraVerify email security score works

Frequently asked questions

What is SPF?

SPF (Sender Policy Framework) is a DNS TXT record that lists which mail servers are allowed to send email for your domain. Receivers check the sending server against it. A record ending in -all tells receivers to reject anything else; ~all only marks it as suspicious.

What is DKIM?

DKIM (DomainKeys Identified Mail) adds a digital signature to each outgoing message using a private key. The matching public key is published in DNS under a selector, such as google._domainkey.example.com. Receivers use it to verify the message was not altered and really came from your domain.

What is DMARC?

DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS record that tells receivers what to do when a message fails SPF and DKIM alignment: nothing (p=none), send it to spam (p=quarantine) or reject it (p=reject). It also lets you receive reports about who is sending mail as your domain.

Why does my domain score less than 100?

Points are awarded per record: MX 25, SPF 25, DKIM 20 and DMARC 30. Missing records score zero, and weak settings such as SPF ~all, DMARC p=none or a 1024-bit DKIM key cost points. The recommendations list shows exactly which change would raise the score.

Why can DKIM not always be found from DNS alone?

DKIM keys live under a selector name that is not listed anywhere in DNS. AstraVerify checks around 80 common selectors used by Google, Microsoft, and popular email services. Providers such as Amazon SES or Postmark use random selectors, so the tool also lets you send one email from your domain to read the real selector and confirm that outgoing mail is signed.

Is AstraVerify free?

Yes. Scanning a domain, the score, the recommendations and the emailed report are free, with no sign-up.