the impersonation test
Can anyone send email as you?
Four DNS records decide whether your mail gets trusted and whether a stranger can forge your domain. Most companies have never checked, and a surprising number are wide open. Takes about three seconds.
Public DNS only — nothing is sent to the domain, nothing is stored unless you ask for the report. DKIM selectors can't be enumerated from outside, so a “not found” there may just mean a custom selector.
Questions
What does this actually check?
MX (can the domain receive mail), SPF (who is allowed to send as it), DKIM (is outgoing mail signed), DMARC (what receivers should do about forgeries, and whether you get told), and MTA-STS (is inbound mail required to use TLS).
Does it send email to my domain?
No. Every check is a public DNS lookup. Nothing is delivered, nothing is probed, and we store nothing unless you ask for the report by email.
It says no DKIM but I have DKIM.
Likely a custom selector. DKIM selectors cannot be enumerated from outside — we try the thirty or so that common providers use. A not-found is 'we could not see it', not 'it is missing'.
Why does DMARC matter most?
Without it, anyone can send mail claiming to be your domain and you never find out. SPF and DKIM describe your legitimate senders; DMARC is the record that tells receivers to actually act on that, and mails you reports when someone tries.
This audit reads your DNS. The other half — whether a mailbox on the far end actually exists — needs an SMTP probe, and no cloud host allows one.
So that part runs on your machine, where your list stays. MIT licensed, no contact database, nothing uploaded.
See the verification gate →