Is your business email set up correctly?

1. MX
2. SPF
3. DKIM
4. DMARC
5. DNSSEC
6. MTA-STS

• Your email is received by Microsoft 365.
• Your email is received by Google Workspace.
• Your email is received by {naam}.
• There is no MX record: this domain cannot receive email. If you do not send email from it either, set SPF to -all and DMARC to reject, so no one can misuse it.
• This domain uses a null MX to indicate that it does not receive email. That is good practice; also set SPF to -all and DMARC to reject.
• There is no SPF record. Recipients then cannot verify who is allowed to send email on your behalf, and your email is more likely to end up in spam.
• There are {n} SPF records. Only one is allowed; with more, SPF fails at every recipient. Merge them into one record.
• The record ends in -all: email from other servers is rejected. That is how it should be.
• The record ends in ~all: email from other servers is marked as suspicious, not rejected. With DMARC on quarantine or reject that is fine; -all is stricter.
• The record ends in ?all: SPF then says nothing about other servers. Use ~all or -all.
• The record ends in +all or a bare all: anyone may then send email on your behalf. That makes SPF worthless; set it to -all.
• The record does not end in all. Close it with ~all or -all.
• The record requires {n} DNS lookups; the limit is 10. Above that, SPF fails at recipients. Remove includes you no longer use, or have the record simplified.
• The record uses {n} of the maximum 10 DNS lookups.
• The include {naam} has no SPF record of its own. That makes your SPF fail; remove the include or correct it.
• The record uses ptr. That is outdated and slow; replace it with an include or an IP address.
• Your email runs through Microsoft 365, but include:spf.protection.outlook.com is missing. Email from Microsoft 365 then fails SPF.
• Your email runs through Google Workspace, but include:_spf.google.com is missing. Email from Google then fails SPF.
• Not sending email from this domain? Then add an SPF record with only v=spf1 -all, so no one can misuse it.
• DKIM key found under: {naam}.
• No DKIM key found under the common names. Your provider may use a different name (selector); enter it at the top to check it.
• Your email runs through Microsoft 365, but there is no DKIM key under selector1 or selector2. Turn on DKIM in the Microsoft Defender portal and add the two CNAME records.
• The key under {naam} is empty (p=). It has been revoked and no longer signs anything.
• The key under {naam} is 1024 bits. That still works, but 2048 bits is the current standard.
• There is no DMARC record. Recipients then do not know what to do with fake email sent in your name, and large email providers require it from anyone who sends a lot of email.
• There are {n} DMARC records. Only one is allowed; otherwise recipients ignore them all.
• The DMARC record lacks a valid policy (p=none, quarantine or reject). Without p= it does not count.
• DMARC is set to p=none: it only measures and does not stop fake email. Check the reports to see whether all your own email gets through correctly, then set it to quarantine and later to reject.
• DMARC is set to p=quarantine: fake email sent in your name goes to spam.
• DMARC is set to p=reject: fake email sent in your name is rejected. That is the strongest setting.
• The policy only applies to {n} per cent of the email (pct). Set it to 100 once your own email gets through correctly.
• There is no report address (rua). That means you cannot see who is sending email in your name; add an address.
• For subdomains the policy is set to none (sp=none). Fake email can still get through there.
• This subdomain has no DMARC record of its own; the policy of the main domain applies.
• This domain's DNS is signed with DNSSEC.
• This domain's DNS is not signed. Not required, but a good extra layer of protection.
• MTA-STS is enabled: mail servers must deliver over an encrypted connection.
• MTA-STS is not enabled. Not required; it prevents email to you from being delivered unencrypted.
• TLS reporting is enabled: you receive a report if encrypted delivery fails.

OKAttentionProblemFor info That is not a valid domain name. Enter something like yourcompany.com.This domain does not exist. Check the spelling.This domain's DNS returns an error. This is often caused by a broken DNSSEC setting, and then no email arrives either.The check did not work: the DNS service could not be reached. Try again in a moment.The link is on your clipboard. Anyone who opens it sees the check for this domain.Copying did not work. The link to this check is in the address bar.