Email security guides
Browse the complete SPF, DKIM, DMARC, MX and related email-authentication knowledge base.
Open the email security hub →SPF · DKIM · DMARC · MX
Assess the email security posture of a domain.
SecuTest reviews externally visible email authentication and routing controls to identify conditions associated with spoofing exposure, broken authentication, weak enforcement and mail configuration errors.
- No mailbox access
- No credentials required
- Public DNS signals only
Email security knowledge hub
Start with the control family, then open the exact remediation guide.
The email-security hub groups the SPF, DKIM, DMARC and MX guides generated from the same checks used in SecuTest reports.
SPF
Presence, syntax, authorization policy and DNS lookup behavior.
SPF presence guide →DKIM
Selectors, public keys, syntax, key strength and signature-verification prerequisites.
DKIM public key guide →DMARC
Presence, policy enforcement, percentage, subdomain policy and reporting.
DMARC enforcement guide →Why email authentication matters
A domain can look legitimate while still publishing weak email controls.
Email authentication is distributed across DNS records, signing infrastructure and receiver policy. A single headline such as “DMARC present” does not tell you whether the full configuration is valid, enforced or operationally safe.
SPF authorization
Check whether SPF exists, whether its syntax is valid, whether the terminal policy is meaningful and whether DNS lookup behavior creates operational risk.
SPF presence guide →DKIM signing signals
Review discoverable selectors, public-key validity, key strength, CNAME chains and conditions that can prevent signature verification.
DKIM public key guide →DMARC enforcement
Distinguish monitoring-only policy from quarantine or reject, and review percentage, subdomain policy and aggregate reporting configuration.
DMARC enforcement guide →Mail routing
Validate MX syntax and resolution and identify cases such as null MX where the published behavior should match the domain's actual mail intent.
MX resolution guide →Interpretation
Missing, invalid and weak are not the same finding.
SecuTest separates configuration presence from syntax, validation and enforcement. This matters because remediation depends on the actual failure mode.
Missing: the expected control is not publicly published.
Invalid: a record exists but may not be usable by receivers because of syntax, key or resolution errors.
Weak: a technically valid control may still provide limited protection, such as DMARC p=none or incomplete enforcement.
Operational: a stronger policy still needs to account for legitimate senders, third-party platforms and production constraints before changes are made.
Assessment workflow
From DNS evidence to a safer mail posture.
- 01
Discover
Read the public SPF, DKIM, DMARC and MX-related signals available for the target domain.
- 02
Validate
Check syntax, resolution, policy semantics and other conditions that affect whether a control works as intended.
- 03
Prioritize
Separate configuration hygiene from findings that materially influence spoofing exposure or authentication reliability.
- 04
Remediate carefully
Use operational guidance to fix legitimate sender alignment before enforcing stronger policies.
Check the published controls
Assess SPF, DKIM and DMARC from the outside.
Start with the free scan, then use the detailed report and remediation guides when you need the complete evidence.
Run Free Scan