{"id":3459,"date":"2026-10-28T09:02:05","date_gmt":"2026-10-28T16:02:05","guid":{"rendered":"https:\/\/cyber.mag212.com\/tools\/email-security-checker\/"},"modified":"2026-10-28T09:04:13","modified_gmt":"2026-10-28T16:04:13","slug":"email-security-checker","status":"publish","type":"page","link":"https:\/\/cyber.mag212.com\/fr\/tools\/email-security-checker\/","title":{"rendered":"V\u00e9rificateur de s\u00e9curit\u00e9 du courriel de domaine"},"content":{"rendered":"\n<div class=\"m212x\" id=\"m212-email-security-checker\">\n<style>\n.m212x{--bg:#0a0f15;--panel:#0f1720;--panel2:#121c27;--line:#1f2d3a;--line2:#2a3b4b;--ink:#e6edf3;--mute:#9fb0c0;--green:#3ee6a0;--red:#ff5468;--cyan:#3cc8f0;--amber:#f6b544;--violet:#a98bff;\n font-family:Inter,system-ui,-apple-system,\"Segoe UI\",sans-serif;color:var(--ink);line-height:1.6;font-size:16px}\n.m212x *{box-sizing:border-box}\n.m212x h2,.m212x h3,.m212x h4,.m212x p,.m212x ul,.m212x ol{margin:0}\n.m212x a{color:var(--cyan)}\n.m212x .hero{position:relative;background:radial-gradient(ellipse at 90% 0%,rgba(60,200,240,.14),transparent 60%),var(--bg);border:1px solid var(--line);border-radius:14px;padding:34px 30px;overflow:hidden;margin-bottom:22px}\n.m212x .hero::before{content:\"\";position:absolute;left:0;right:0;top:0;height:4px;background:linear-gradient(90deg,var(--green),var(--cyan) 60%,var(--red))}\n.m212x .kick{font-size:12px;font-weight:800;letter-spacing:.2em;text-transform:uppercase;color:var(--cyan);margin-bottom:8px}\n.m212x .hero h2{font-size:clamp(26px,4.6vw,40px);line-height:1.1;font-weight:800;margin-bottom:10px}\n.m212x .hero h2 span{color:var(--green)}\n.m212x .hero p{color:var(--mute);font-size:17px;max-width:680px}\n.m212x .sec{background:var(--panel);border:1px solid var(--line);border-radius:14px;padding:24px;margin-bottom:22px;scroll-margin-top:110px}\n.m212x .sec h3{font-size:22px;font-weight:800;margin-bottom:8px}\n.m212x .sec h4{font-size:16px;font-weight:800;margin:16px 0 6px}\n.m212x .sec p{color:#cdd8e2;margin-bottom:10px}\n.m212x .lead{color:var(--mute) !important;margin-bottom:16px !important}\n.m212x .grid{display:grid;gap:14px;grid-template-columns:repeat(auto-fit,minmax(230px,1fr))}\n.m212x .card{display:block;background:var(--panel2);border:1px solid var(--line2);border-radius:10px;padding:18px;text-decoration:none;color:var(--ink)}\n.m212x a.card:hover{border-color:var(--green)}\n.m212x .card b{display:block;font-size:17px;margin-bottom:6px}\n.m212x .card p{color:var(--mute);font-size:14.5px;margin:0}\n.m212x .card .go{display:inline-block;margin-top:10px;font-size:13px;font-weight:800;letter-spacing:.06em;color:var(--green)}\n.m212x .ic{font-size:26px;display:block;margin-bottom:8px}\n.m212x ul.l,.m212x ol.l{padding-left:22px;color:#cdd8e2;margin-bottom:10px}\n.m212x ul.l li,.m212x ol.l li{margin-bottom:6px}\n.m212x table{width:100%;border-collapse:collapse;font-size:14.5px;margin:6px 0 12px}\n.m212x th{text-align:left;font-size:12px;letter-spacing:.12em;text-transform:uppercase;color:var(--mute);border-bottom:1px solid var(--line2);padding:8px}\n.m212x td{border-bottom:1px solid var(--line);padding:8px;vertical-align:top;color:#d3dde6}\n.m212x code,.m212x .mono{font-family:\"JetBrains Mono\",\"DejaVu Sans Mono\",Consolas,monospace;font-size:.9em}\n.m212x code{background:rgba(60,200,240,.1);color:#bfe9ff;padding:1px 5px;border-radius:4px}\n.m212x pre{font-family:\"JetBrains Mono\",\"DejaVu Sans Mono\",Consolas,monospace;font-size:13.5px;background:#060a0f;border:1px solid var(--line);border-left:3px solid var(--green);border-radius:6px;padding:12px 14px;overflow-x:auto;color:#cfe8d9;margin:6px 0 12px;white-space:pre}\n.m212x .callout{border:1px solid rgba(246,181,68,.4);background:rgba(246,181,68,.08);border-radius:10px;padding:14px 16px;margin:12px 0}\n.m212x .callout b{color:var(--amber)}\n.m212x .pill{display:inline-block;font-size:12px;font-weight:800;letter-spacing:.06em;padding:2px 9px;border-radius:999px;border:1px solid}\n.m212x .p-n{color:#9fb0c0;border-color:#3a4b5b}\n.m212x .p-l{color:var(--green);border-color:rgba(62,230,160,.5);background:rgba(62,230,160,.08)}\n.m212x .p-m{color:var(--amber);border-color:rgba(246,181,68,.5);background:rgba(246,181,68,.08)}\n.m212x .p-h{color:#ff8a5c;border-color:rgba(255,138,92,.5);background:rgba(255,138,92,.08)}\n.m212x .p-c{color:var(--red);border-color:rgba(255,84,104,.5);background:rgba(255,84,104,.08)}\n.m212x .toc{display:flex;flex-wrap:wrap;gap:8px;margin-top:18px}\n.m212x .toc a{font-size:14px;font-weight:700;text-decoration:none;color:var(--ink);background:var(--panel2);border:1px solid var(--line2);border-radius:999px;padding:7px 13px}\n.m212x .toc a:hover{border-color:var(--green);color:var(--green)}\n.m212x input[type=text],.m212x input[type=search],.m212x input[type=url]{width:100%;background:#060a0f;color:var(--ink);border:1px solid var(--line2);border-radius:8px;padding:12px 14px;font-size:16px;font-family:inherit}\n.m212x input:focus{outline:2px solid var(--cyan);outline-offset:1px}\n.m212x button{font-family:inherit;font-size:15px;font-weight:700;cursor:pointer;border-radius:8px;padding:11px 16px;border:1px solid var(--line2);background:var(--panel2);color:var(--ink)}\n.m212x button.pri{background:var(--green);color:#04130c;border-color:var(--green)}\n.m212x .help{display:flex;gap:18px;align-items:center;flex-wrap:wrap;background:linear-gradient(90deg,rgba(60,200,240,.12),rgba(62,230,160,.05));border:1px solid rgba(60,200,240,.35);border-radius:14px;padding:20px 24px}\n.m212x .help div{flex:1;min-width:240px}\n.m212x .help a.cta{display:inline-block;background:var(--cyan);color:#03141b;font-weight:800;text-decoration:none;border-radius:8px;padding:12px 18px}\n.m212x .small{font-size:13.5px;color:var(--mute)}\n<\/style>\n<section class=\"hero\"><div class=\"kick\">MAG212 CYBER \u00b7 Tools<\/div><h2>Domain email security <span>checker.<\/span><\/h2><p>Can criminals send email pretending to be your company? Enter a domain to grade its SPF, DKIM, DMARC, MX, MTA-STS and BIMI records \u2014 with the exact DNS records to fix any gaps.<\/p><div class=\"toc\"><a href=\"#m212es-tool\">Check a domain<\/a><a href=\"#m212es-explain\">What the records do<\/a><a href=\"#m212es-roll\">Safe DMARC rollout<\/a><\/div><\/section><style>.m212x .sn-row{display:flex;gap:8px;flex-wrap:wrap}\n.m212x .sn-ex{display:flex;gap:6px;flex-wrap:wrap;margin:10px 0 2px}.m212x .sn-ex button{padding:5px 10px;font-size:13px;font-family:\"JetBrains Mono\",\"DejaVu Sans Mono\",monospace}\n.m212x .sn-kv{display:grid;grid-template-columns:repeat(auto-fit,minmax(min(100%,230px),1fr));gap:10px;margin:14px 0}\n.m212x .sn-kv div{background:#060a0f;border:1px solid var(--line2);border-radius:10px;padding:10px 12px;min-width:0}\n.m212x .sn-kv span{display:block;font-size:11.5px;letter-spacing:.12em;text-transform:uppercase;color:var(--mute)}\n.m212x .sn-kv b{font-family:\"JetBrains Mono\",\"DejaVu Sans Mono\",monospace;font-size:15px;color:#e6edf3;word-break:break-all}\n.m212x .sn-err{color:var(--red);display:none;margin-top:8px}\n.m212x .sn-tw{overflow-x:auto;-webkit-overflow-scrolling:touch}.m212x .sn-tw table{min-width:560px}\n.m212x .sn-head{display:flex;justify-content:space-between;align-items:center;gap:10px;flex-wrap:wrap}\n.m212x textarea{width:100%;min-height:150px;background:#060a0f;color:var(--ink);border:1px solid var(--line2);border-radius:8px;padding:12px 14px;font:14px\/1.5 \"JetBrains Mono\",\"DejaVu Sans Mono\",monospace}\n.m212x select{background:#060a0f;color:var(--ink);border:1px solid var(--line2);border-radius:8px;padding:10px 12px;font-size:15px;font-family:inherit}\n.m212x .verdict{display:flex;gap:16px;align-items:center;flex-wrap:wrap;background:#060a0f;border:1px solid var(--line2);border-radius:12px;padding:16px 18px;margin:16px 0 12px}\n.m212x .big{font-size:52px;font-weight:800;line-height:1;min-width:80px}\n.m212x .fl{padding:10px 2px;border-bottom:1px solid var(--line);display:flex;gap:10px}.m212x .fl span{flex:none}\n.m212x .rec{background:#060a0f;border:1px solid var(--line2);border-radius:10px;padding:12px 14px;margin:8px 0}\n.m212x .rec b{display:block;margin-bottom:4px}.m212x .rec pre{margin:6px 0 0;white-space:pre-wrap;word-break:break-all}\n.m212x .meter{height:10px;border-radius:99px;background:#1a2733;overflow:hidden;margin:8px 0}.m212x .meter i{display:block;height:100%;width:0;border-radius:99px;transition:width .25s}\n<\/style>\n<section class=\"sec\" id=\"m212es-tool\"><h3>Check a domain<\/h3>\n<div class=\"sn-row\"><input type=\"text\" id=\"m212esd\" placeholder=\"yourcompany.com\" aria-label=\"Domain name\" spellcheck=\"false\" autocomplete=\"off\" style=\"flex:1;min-width:220px\"><button type=\"button\" class=\"pri\" id=\"m212esgo\">Check domain<\/button><\/div>\n<div class=\"sn-row\" style=\"margin-top:8px\"><input type=\"text\" id=\"m212essel\" placeholder=\"Optional: your DKIM selector (e.g. s1)\" aria-label=\"DKIM selector\" spellcheck=\"false\" style=\"flex:1;min-width:220px\"><\/div>\n<div class=\"sn-ex\"><span class=\"small\" style=\"align-self:center\">Try:<\/span><button type=\"button\" data-ex=\"google.com\">google.com<\/button><button type=\"button\" data-ex=\"microsoft.com\">microsoft.com<\/button><button type=\"button\" data-ex=\"mag212.com\">mag212.com<\/button><\/div>\n<p class=\"small\" style=\"margin-top:10px\">\ud83d\udd12 Only the domain name is looked up, using public DNS-over-HTTPS resolvers (Google Public DNS, with Cloudflare as a fallback). These are public records anyone can query. Nothing is stored by MAG212 CYBER.<\/p>\n<p class=\"small sn-err\" id=\"m212eserr\"><\/p>\n<div id=\"m212esout\" style=\"display:none\">\n<div class=\"verdict\"><div class=\"big\" id=\"m212esgr\"><\/div><div><div style=\"font-size:20px;font-weight:800\" id=\"m212esv\"><\/div><div class=\"small\" id=\"m212essum\"><\/div><\/div><\/div>\n<div class=\"sn-kv\" id=\"m212eskv\"><\/div>\n<h4>Findings<\/h4><div id=\"m212esf\"><\/div>\n<h4>Recommended DNS records<\/h4><div id=\"m212esrec\"><\/div>\n<h4>Raw records found<\/h4><div class=\"sn-tw\"><table id=\"m212esraw\"><\/table><\/div>\n<\/div><\/section>\n<section class=\"sec\" id=\"m212es-explain\"><h3>What the records do<\/h3><div class=\"sn-tw\"><table><tr><th>Record<\/th><th>Where<\/th><th>What it does<\/th><\/tr>\n<tr><td><b>SPF<\/b><\/td><td class=\"mono\">TXT on domain<\/td><td>Lists the servers allowed to send mail for the domain. Must be one record, under 10 DNS lookups, ending in <code>~all<\/code> or <code>-all<\/code>.<\/td><\/tr>\n<tr><td><b>DKIM<\/b><\/td><td class=\"mono\">TXT on selector._domainkey<\/td><td>Public key that verifies the cryptographic signature your mail server adds to every message.<\/td><\/tr>\n<tr><td><b>DMARC<\/b><\/td><td class=\"mono\">TXT on _dmarc<\/td><td>Tells receivers what to do when a message fails SPF and DKIM alignment (<code>none<\/code>, <code>quarantine<\/code> or <code>reject<\/code>) and where to send reports.<\/td><\/tr>\n<tr><td><b>MTA-STS<\/b><\/td><td class=\"mono\">TXT on _mta-sts + policy file<\/td><td>Forces other mail servers to use verified TLS when delivering to you, blocking downgrade attacks.<\/td><\/tr>\n<tr><td><b>TLS-RPT<\/b><\/td><td class=\"mono\">TXT on _smtp._tls<\/td><td>Sends you reports when TLS delivery to your domain fails.<\/td><\/tr>\n<tr><td><b>BIMI<\/b><\/td><td class=\"mono\">TXT on default._bimi<\/td><td>Shows your logo in supporting inboxes. Requires DMARC at quarantine or reject.<\/td><\/tr><\/table><\/div>\n<p class=\"small\" style=\"margin-top:8px\">Since 2024, Google and Yahoo require bulk senders to have SPF, DKIM and at least a <code>p=none<\/code> DMARC record. Got a suspicious message? Use the <a href=\"\/tools\/email-header-analyzer\/\">email header analyzer<\/a>.<\/p><\/section>\n<section class=\"sec\" id=\"m212es-roll\"><h3>Safe DMARC rollout<\/h3><ol class=\"l\"><li><b>Monitor:<\/b> publish <code>p=none<\/code> with a <code>rua=<\/code> reporting address and read the reports for 2\u20134 weeks.<\/li><li><b>Fix:<\/b> add every legitimate sender (CRM, newsletters, invoicing, help desk) to SPF and enable DKIM signing for each.<\/li><li><b>Quarantine:<\/b> move to <code>p=quarantine<\/code>, optionally with <code>pct=25<\/code> and then 100.<\/li><li><b>Reject:<\/b> when reports are clean, move to <code>p=reject<\/code>. Spoofed mail is now blocked.<\/li><li><b>Parked domains:<\/b> domains that never send email should publish <code>v=spf1 -all<\/code> and <code>v=DMARC1; p=reject<\/code>.<\/li><\/ol>\n<p class=\"small\">Want us to run your DMARC rollout? <a href=\"\/contact\/\">Contact MAG212 CYBER<\/a>.<\/p><\/section>\n<p class=\"small noprint\" style=\"margin:-8px 0 18px;padding:0 4px\">\u2696\ufe0f For education and use on systems you own or are authorised to test. Results are automated guidance, not a professional audit. See our <a href=\"\/terms-of-use\/\">terms of use<\/a> and <a href=\"\/privacy-policy\/\">privacy policy<\/a>.<\/p>\n<div class=\"help\"><div><div class=\"kick\" style=\"margin-bottom:4px\">Need expert help?<\/div>\n<p style=\"font-size:17px;margin:0\"><b>MAG212 CYBER<\/b> offers network and cybersecurity consultation, plus security seminars for organisations around the world.<\/p><\/div>\n<a class=\"cta\" href=\"\/services\/\">Explore our services \u2192<\/a><\/div>\n<script>\n(function(){\nvar root=document.getElementById('m212-email-security-checker'); if(!root) return;\nfunction $(i){ return document.getElementById(i); }\nfunction esc(t){ var d=document.createElement('div'); d.textContent=t==null?'':String(t); return d.innerHTML; }\nvar CACHE={};\nasync function dns(name,type){\n  var key=name+'|'+type; if(CACHE[key]) return CACHE[key];\n  var u=new URL('https:\/\/dns.google\/resolve'); u.searchParams.set('name',name); u.searchParams.set('type',type);\n  var j=null;\n  try{ var r=await fetch(u.toString()); if(r.ok) j=await r.json(); }catch(e){}\n  if(!j){ var c=new URL('https:\/\/cloudflare-dns.com\/dns-query'); c.searchParams.set('name',name); c.searchParams.set('type',type); try{ var r2=await fetch(c.toString(),{headers:{accept:'application\/dns-json'}}); if(r2.ok) j=await r2.json(); }catch(e){} }\n  if(!j) throw new Error('DNS lookup failed');\n  CACHE[key]=j; return j;\n}\nfunction txt(data){ return String(data).replace(\/^\"|\"$\/g,'').replace(\/\"\\s*\"\/g,''); }\nasync function txts(name){ var j=await dns(name,'TXT'); return (j.Answer||[]).filter(function(a){ return a.type===16; }).map(function(a){ return txt(a.data); }); }\nvar PROV=[[\/google\\.com\\.?$|googlemail\\.com\\.?$\/i,'Google Workspace','include:_spf.google.com'],[\/outlook\\.com\\.?$\/i,'Microsoft 365','include:spf.protection.outlook.com'],[\/zoho\\.(com|eu|in)\\.?$\/i,'Zoho Mail','include:zoho.com'],[\/hostinger\\.com\\.?$\/i,'Hostinger Email','include:_spf.mail.hostinger.com'],[\/titan\\.email\\.?$\/i,'Titan Email (Hostinger)','include:spf.titan.email'],[\/protonmail\\.ch\\.?$\/i,'Proton Mail','include:_spf.protonmail.ch'],[\/messagingengine\\.com\\.?$\/i,'Fastmail','include:spf.messagingengine.com'],[\/secureserver\\.net\\.?$\/i,'GoDaddy','include:secureserver.net'],[\/mimecast\/i,'Mimecast',''],[\/pphosted\\.com\\.?$\/i,'Proofpoint',''],[\/icloud\\.com\\.?$\/i,'iCloud Mail','include:icloud.com']];\nvar SELS=['google','selector1','selector2','default','k1','k2','k3','s1','s2','dkim','mail','smtp','mx','zoho','zmail','protonmail','protonmail2','protonmail3','fm1','fm2','fm3','mandrill','mxvault','hostingermail1','hostingermail2','titan1','titan2','sig1','everlytic'];\nasync function spfCount(rec,depth,seen){\n  if(depth>10) return {n:0,voids:0};\n  var terms=rec.split(\/\\s+\/).slice(1), n=0, voids=0;\n  for(var i=0;i<terms.length;i++){\n    var t=terms[i].replace(\/^[+\\-~?]\/,'').toLowerCase(), m;\n    if(\/^(a|mx|ptr)([:\\\/]|$)\/.test(t) ? true : \/^exists:\/.test(t)) n++;\n    if((m=t.match(\/^include:(.+)$\/)) ? true : !!(m=t.match(\/^redirect=(.+)$\/))){\n      n++; var d=m[1]; if(seen.indexOf(d)>-1) continue; seen.push(d);\n      try{ var rs=(await txts(d)).filter(function(x){ return \/^v=spf1(\\s|$)\/i.test(x); }); if(!rs.length){ voids++; continue; } var sub=await spfCount(rs[0],depth+1,seen); n+=sub.n; voids+=sub.voids; }catch(e){}\n    }\n  }\n  return {n:n,voids:voids};\n}\nfunction tag(rec,k){ var m=rec.match(new RegExp('(^|;)\\\\s*'+k+'\\\\s*=\\\\s*([^;]*)','i')); return m?m[2].trim():null; }\nasync function check(domain,selector){\n  var out={domain:domain,f:[],rec:[],raw:[],score:100,kv:[]};\n  function F(lvl,msg,pen){ out.f.push([lvl,msg]); if(pen) out.score-=pen; }\n  var mxj=await dns(domain,'MX'), aj=null;\n  if(mxj.Status===3){ out.nx=true; return out; }\n  var mx=(mxj.Answer||[]).filter(function(a){ return a.type===15; }).map(function(a){ var p=a.data.split(' '); return {pref:+p[0],host:(p[1]||'').replace(\/\\.$\/,'')}; }).sort(function(a,b){ return a.pref-b.pref; });\n  var nullmx=mx.length===1 ? mx[0].host==='' : false;\n  var prov=null; mx.forEach(function(m){ PROV.forEach(function(p){ if(!prov) if(p[0].test(m.host)) prov=p; }); });\n  out.kv.push(['Mail servers (MX)', mx.length ? (nullmx?'Null MX \u2014 domain accepts no mail':mx.map(function(m){ return m.pref+' '+m.host; }).join(', ')) : 'None']);\n  out.kv.push(['Mail provider', prov?prov[1]:(mx.length?'Other \/ self-hosted':'\u2014')]);\n  out.kv.push(['DNSSEC', mxj.AD?'Validated \u2713':'Not signed']);\n  mx.forEach(function(m){ out.raw.push(['MX',domain,m.pref+' '+m.host]); });\n  var sendsMail=mx.length>0 ? !nullmx : false;\n  var root=await txts(domain), spfs=root.filter(function(x){ return \/^v=spf1(\\s|$)\/i.test(x); });\n  spfs.forEach(function(s){ out.raw.push(['TXT (SPF)',domain,s]); });\n  var spfOK=false, spfInc=prov ? prov[2] : 'include:<your-provider>';\n  if(!spfs.length){ F('bad','No SPF record. Anyone can claim to send mail from '+domain+'.',25); }\n  else if(spfs.length>1){ F('bad','There are '+spfs.length+' SPF records. Only one is allowed; receivers treat this as a permanent error (permerror).',20); }\n  else {\n    var s=spfs[0], all=(s.match(\/[+\\-~?]?all\\b\/i)||[''])[0].toLowerCase();\n    if(all==='+all' ? true : all==='all') F('bad','SPF ends with \"+all\", which authorises every server on the internet to send as you.',25);\n    else if(all==='-all'){ F('ok','SPF hard-fails unauthorised senders (-all).'); spfOK=true; }\n    else if(all==='~all'){ F('ok','SPF soft-fails unauthorised senders (~all) \u2014 fine when DMARC is enforced.'); spfOK=true; }\n    else if(all==='?all') F('warn','SPF ends with \"?all\" (neutral), which gives no protection.',15);\n    else if(\/redirect=\/i.test(s)){ F('ok','SPF uses a redirect to another domain\\'s policy.'); spfOK=true; }\n    else F('warn','SPF has no \"all\" mechanism at the end, so unlisted servers are not rejected.',15);\n    if(\/\\bptr\\b\/i.test(s)) F('warn','SPF uses the \"ptr\" mechanism, which is deprecated (RFC 7208) and slow.',3);\n    var c=await spfCount(s,0,[]);\n    out.kv.push(['SPF DNS lookups',c.n+' of 10']);\n    if(c.n>10) F('bad','SPF needs '+c.n+' DNS lookups. The limit is 10 \u2014 receivers will return permerror and SPF fails for every message.',15);\n    else if(c.n>8) F('warn','SPF uses '+c.n+' of 10 allowed DNS lookups. Adding one more service could break it.',2);\n    if(c.voids>2) F('warn','SPF includes '+c.voids+' domains that have no SPF record (void lookups; the limit is 2).',3);\n  }\n  var dm=(await txts('_dmarc.'+domain)).filter(function(x){ return \/^v=DMARC1\/i.test(x); });\n  dm.forEach(function(d){ out.raw.push(['TXT (DMARC)','_dmarc.'+domain,d]); });\n  var p=null;\n  if(!dm.length){ F('bad','No DMARC record. Receivers have no instructions for spoofed mail and you get no reports.',30); }\n  else if(dm.length>1){ F('bad','Multiple DMARC records found. Receivers will ignore DMARC entirely.',25); }\n  else {\n    var d=dm[0]; p=(tag(d,'p')||'').toLowerCase(); var pct=tag(d,'pct'), rua=tag(d,'rua'), sp=(tag(d,'sp')||'').toLowerCase();\n    out.kv.push(['DMARC policy','p='+(p||'missing')+(pct?' \u00b7 pct='+pct:'')]);\n    if(p==='reject') F('ok','DMARC policy is reject \u2014 spoofed mail is blocked.');\n    else if(p==='quarantine') F('ok','DMARC policy is quarantine \u2014 spoofed mail goes to spam. Consider moving to reject.',5);\n    else if(p==='none') F('warn','DMARC is in monitoring mode only (p=none). Spoofed mail is still delivered.',15);\n    else F('bad','DMARC record has no valid p= policy.',20);\n    if(pct) if(+pct<100) F('warn','DMARC applies to only '+pct+'% of failing mail (pct='+pct+').',3);\n    if(!rua) F('warn','DMARC has no rua= reporting address, so you never see who is sending as you.',3); else F('ok','DMARC aggregate reports go to '+rua+'.');\n    if(sp==='none') if(p!=='none') F('warn','Subdomains are excluded from enforcement (sp=none). Attackers can spoof anything.'+domain+'.',3);\n  }\n  var sels=SELS.slice(); if(selector) sels.unshift(selector.trim().toLowerCase());\n  var found=[];\n  await Promise.all(sels.map(async function(sel){ try{ var r=(await txts(sel+'._domainkey.'+domain)).filter(function(x){ return \/(^|;)\\s*p=\/i.test(x) ? true : \/v=DKIM1\/i.test(x); }); if(r.length) found.push([sel,r[0]]); }catch(e){} }));\n  found.forEach(function(x){ out.raw.push(['TXT (DKIM)',x[0]+'._domainkey.'+domain,x[1].length>120?x[1].slice(0,120)+'\u2026':x[1]]); });\n  var live=found.filter(function(x){ return !\/(^|;)\\s*p=\\s*(;|$)\/i.test(x[1]); });\n  out.kv.push(['DKIM selectors found',found.length?found.map(function(x){ return x[0]; }).join(', '):'None of '+sels.length+' common selectors']);\n  if(live.length) F('ok','DKIM public key published (selector: '+live.map(function(x){ return x[0]; }).join(', ')+').');\n  else if(found.length) F('warn','DKIM record found but the key is empty (revoked).',10);\n  else if(sendsMail) F('warn','No DKIM key found under common selectors. If you know your selector, enter it above \u2014 otherwise enable DKIM signing with your provider.',10);\n  var sts=(await txts('_mta-sts.'+domain)).filter(function(x){ return \/^v=STSv1\/i.test(x); }), rpt=(await txts('_smtp._tls.'+domain)).filter(function(x){ return \/^v=TLSRPTv1\/i.test(x); }), bimi=(await txts('default._bimi.'+domain)).filter(function(x){ return \/^v=BIMI1\/i.test(x); });\n  sts.forEach(function(x){ out.raw.push(['TXT (MTA-STS)','_mta-sts.'+domain,x]); }); rpt.forEach(function(x){ out.raw.push(['TXT (TLS-RPT)','_smtp._tls.'+domain,x]); }); bimi.forEach(function(x){ out.raw.push(['TXT (BIMI)','default._bimi.'+domain,x]); });\n  if(sendsMail){ if(sts.length) F('ok','MTA-STS is published \u2014 inbound mail must use verified TLS.'); else F('info','No MTA-STS. Inbound mail could be downgraded to unencrypted delivery by an attacker in the path.',2);\n    if(rpt.length) F('ok','TLS-RPT reporting is enabled.'); else F('info','No TLS-RPT record, so you won\\'t hear about TLS delivery failures.',1); }\n  if(bimi.length) F('ok','BIMI record published \u2014 your logo can appear in supporting inboxes.');\n  if(!sendsMail){ if(!mx.length ? true : nullmx){ F('info','This domain has no mail servers. If it never sends email, lock it down with a null SPF and a reject DMARC policy.'); } }\n  if(out.score<0) out.score=0;\n  if(!spfs.length ? true : !spfOK) out.rec.push(['SPF record (TXT on '+domain+')', sendsMail ? 'v=spf1 mx '+spfInc+' ~all' : 'v=spf1 -all', sendsMail ? 'Add an include for every service that sends mail as you (newsletters, CRM, invoicing). Keep it to one record and under 10 lookups.' : 'This domain does not send mail, so authorise nobody.']);\n  if(p!=='reject') out.rec.push(['DMARC record (TXT on _dmarc.'+domain+')', !sendsMail ? 'v=DMARC1; p=reject; adkim=s; aspf=s' : (p==='quarantine' ? 'v=DMARC1; p=reject; rua=mailto:dmarc@'+domain : (p==='none' ? 'v=DMARC1; p=quarantine; rua=mailto:dmarc@'+domain : 'v=DMARC1; p=none; rua=mailto:dmarc@'+domain)), !sendsMail ? 'Blocks anyone from sending as this domain.' : (p ? 'Next step on the rollout path. Read your reports first.' : 'Start in monitoring mode, read the reports for 2\u20134 weeks, then move to quarantine and reject.')]);\n  if(sendsMail) if(!live.length) out.rec.push(['DKIM', '(generated by your mail provider)', prov ? 'Turn on DKIM signing in '+prov[1]+'\\'s admin console and publish the record it gives you.' : 'Turn on DKIM signing in your mail platform and publish the TXT or CNAME record it gives you.']);\n  if(sendsMail) if(!rpt.length) out.rec.push(['TLS-RPT (TXT on _smtp._tls.'+domain+')','v=TLSRPTv1; rua=mailto:tls-reports@'+domain,'Receive reports about TLS delivery problems.']);\n  return out;\n}\nfunction grade(s){ if(s>=90) return ['A','var(--green)','Well protected']; if(s>=80) return ['B','var(--green)','Good, with room to improve']; if(s>=65) return ['C','var(--amber)','Partly protected']; if(s>=50) return ['D','#ff8a5c','Weak \u2014 spoofing likely possible']; return ['F','var(--red)','Unprotected \u2014 easy to spoof']; }\nvar busy=false;\nasync function run(){\n  if(busy) return; var d=$('m212esd').value.trim().toLowerCase().replace(\/^https?:\\\/\\\/\/,'').replace(\/^.*@\/,'').replace(\/[\\\/?#].*$\/,'').replace(\/\\.$\/,''), err=$('m212eserr'), out=$('m212esout');\n  if(!\/^(?=.{3,253}$)([a-z0-9](-*[a-z0-9])*\\.)+[a-z]{2,63}$\/.test(d)){ err.textContent='Enter a domain name such as yourcompany.com.'; err.style.display='block'; out.style.display='none'; return; }\n  err.style.display='none'; busy=true; var b=$('m212esgo'); b.textContent='Checking\u2026'; b.disabled=true;\n  try{\n    var r=await check(d,$('m212essel').value);\n    if(r.nx){ err.textContent=d+' does not exist in DNS (NXDOMAIN).'; err.style.display='block'; out.style.display='none'; return; }\n    out.style.display='block'; var g=grade(r.score);\n    $('m212esgr').textContent=g[0]; $('m212esgr').style.color=g[1]; $('m212esv').textContent=g[2]; $('m212esv').style.color=g[1];\n    $('m212essum').textContent=d+' \u00b7 score '+r.score+'\/100 \u00b7 checked '+new Date().toLocaleString();\n    $('m212eskv').innerHTML=r.kv.map(function(x){ return '<div><span>'+esc(x[0])+'<\/span><b>'+esc(x[1])+'<\/b><\/div>'; }).join('');\n    var o={bad:0,warn:1,info:2,ok:3}; r.f.sort(function(a,b){ return o[a[0]]-o[b[0]]; });\n    $('m212esf').innerHTML=r.f.map(function(x){ return '<div class=\"fl\"><span>'+({bad:'\ud83d\udea9',warn:'\u26a0\ufe0f',info:'\u2139\ufe0f',ok:'\u2705'})[x[0]]+'<\/span><div>'+esc(x[1])+'<\/div><\/div>'; }).join('');\n    $('m212esrec').innerHTML=r.rec.length ? r.rec.map(function(x){ return '<div class=\"rec\"><b>'+esc(x[0])+'<\/b><div class=\"small\">'+esc(x[2])+'<\/div><pre>'+esc(x[1])+'<\/pre><\/div>'; }).join('') : '<p>Nothing to add \u2014 great job. \ud83c\udf89<\/p>';\n    $('m212esraw').innerHTML='<tr><th>Type<\/th><th>Name<\/th><th>Value<\/th><\/tr>'+(r.raw.map(function(x){ return '<tr><td>'+esc(x[0])+'<\/td><td class=\"mono\">'+esc(x[1])+'<\/td><td class=\"mono\" style=\"word-break:break-all\">'+esc(x[2])+'<\/td><\/tr>'; }).join('') || '<tr><td colspan=\"3\">No records found.<\/td><\/tr>');\n  }catch(e){ err.textContent='DNS lookup failed. Check your connection or try again in a moment.'; err.style.display='block'; }\n  finally{ busy=false; b.textContent='Check domain'; b.disabled=false; }\n}\n$('m212esgo').addEventListener('click',run);\n$('m212esd').addEventListener('keydown',function(e){ if(e.key==='Enter') run(); });\nArray.prototype.forEach.call(root.querySelectorAll('[data-ex]'),function(b){ b.addEventListener('click',function(){ $('m212esd').value=b.getAttribute('data-ex'); run(); }); });\nwindow.m212es=check;\n})();\n<\/script>\n<\/div>\n\n","protected":false},"excerpt":{"rendered":"<p>MAG212 CYBER \u00b7 Tools Domain email security checker. Can criminals send email pretending to be your company? Enter a domain to grade its SPF, DKIM, DMARC, MX, MTA-STS and BIMI records \u2014 with the exact DNS records to fix any gaps. Check a domainWhat the records doSafe DMARC rollout Check a domain Check domain Try:google.commicrosoft.commag212.com [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":3386,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-3459","page","type-page","status-publish","hentry"],"_hostinger_reach_plugin_has_subscription_block":false,"_hostinger_reach_plugin_is_elementor":false,"_links":{"self":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3459","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/comments?post=3459"}],"version-history":[{"count":1,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3459\/revisions"}],"predecessor-version":[{"id":3484,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3459\/revisions\/3484"}],"up":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3386"}],"wp:attachment":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media?parent=3459"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}