Pillar 1
✅ Valid Record
SPF (Sender Policy Framework)
Defines authorized outbound mail servers and IP ranges allowed to send emails on behalf of this domain.
v=spf1 include:_spf.stripe.com ~all
Email Domain Security Checker
Audit domain email security, inspect SPF records, DKIM authentication, DMARC enforcement policies, and MX servers.
Example Domains:
Security Rating
A+
Full Enforcement (Spoofing Immune)
stripe.com
This domain is protected with strict DMARC quarantine/reject policies, valid SPF records, and active BIMI certified brand logos. Outbound email is highly resilient to phishing impersonation.
Pillar 2
✅ Reject Policy (p=reject)
DMARC Enforcement
Instructs recipient mail servers to block or quarantine forged phishing emails failing SPF/DKIM checks.
v=DMARC1; p=reject; rua=mailto:dmarc-rua@stripe.com; pct=100;
Pillar 3
✅ Enabled (2048-bit RSA)
DKIM (Cryptographic Signatures)
Attaches cryptographic signatures to email headers verifying messages were not tampered with in transit.
k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQ...
Pillar 4
✅ BIMI VMC Verified
BIMI & Verified Brand Logo
Displays verified company logo beside subject lines in Gmail, Apple Mail, and Yahoo Mail inboxes.
v=BIMI1; l=https://stripe.com/logo.svg; a=https://stripe.com/vmc.pem;
About this tool
How to use it
- Enter a domain name (e.g. stripe.com, google.com, or yourcompany.com) into the lookup field.
- Click 'Audit Email Security' to initiate DNS-over-HTTPS queries for SPF, DKIM, DMARC, and BIMI records.
- Inspect the Security Posture Score (A+ to F) and analyze the 4 Authentication Pillars.
- Review actionable DNS remediation recommendations to enforce strict 'p=reject' anti-phishing policies.
Why it matters
Email deliverability and anti-spoofing protection require correctly configured SPF, DKIM, and DMARC DNS records. Modern email providers (Google & Yahoo) mandate these protocols to prevent phishing and ensure inbox delivery.
When to use it
Use this audit tool when setting up new corporate email domains, investigating email delivery bounces, preparing for bulk newsletter campaigns, or verifying vendor email security.
Good to know
Queries public DNS records via Cloudflare and Google DNS-over-HTTPS (DoH) endpoints in real time without intermediate proxies.
Common questions
What is DMARC and why is a 'p=reject' policy critical?
DMARC (Domain-based Message Authentication, Reporting, and Conformance) tells recipient mail servers how to handle emails failing SPF or DKIM checks. A policy of 'p=reject' instructs servers to immediately discard unauthorized spoofed emails, preventing phishing attacks.
What is SPF (Sender Policy Framework)?
SPF is a DNS TXT record specifying the exact IP addresses and mail servers authorized to send emails on behalf of your domain name.
What is DKIM (DomainKeys Identified Mail)?
DKIM provides a cryptographic signature in outgoing email headers verified against a public key published in the sender's DNS records, ensuring messages are not tampered with in transit.
What is BIMI (Brand Indicators for Message Identification)?
BIMI allows domains with enforced DMARC policies to display their official verified brand logo directly beside messages in supported inboxes like Gmail, Apple Mail, and Yahoo.
Are audited domain records stored on your servers?
No. All DNS queries execute via standard client-side browser requests directly to public DoH resolvers with zero logging or tracking.