Domain Security Scan
One-click grade for SPF, DKIM, DMARC, MX and DNSSEC posture.
What this plugin does
The Domain Security Scan interrogates a domain's public DNS to grade its overall email-authentication posture. It resolves the SPF, DKIM and DMARC records, verifies mail-exchanger routing, and checks whether DNSSEC is enabled — then rolls the results into a single A–F score.
We query authoritative nameservers directly for TXT, MX and DNSKEY records — no cached results.
SPF mechanisms, DKIM selectors and DMARC policy strings are parsed and validated against RFC 7208, 6376 and 7489.
Each check contributes weighted points. Strict DMARC enforcement, a valid DKIM key ≥ 2048 bits, and DNSSEC each push the score higher.
Signals we analyse
- SPF record presence, syntax and lookup count (max 10)
- DKIM selector discovery and public key strength
- DMARC policy (none / quarantine / reject) and alignment
- MX host reachability and TLS support
- DNSSEC chain of trust
Common use cases
- Pre-sales due diligence on a supplier's email hygiene
- Baseline audit before rolling out DMARC enforcement
- Monitor tenants and customer domains at scale
What a full scan returns
This is what the paid, deep-scan version of the plugin produces — a full breakdown you can export as PDF or JSON.
- passSPFv=spf1 include:_spf.google.com -all
- passDKIMselector1 · RSA 2048-bit
- warnDMARCp=quarantine; pct=100; rua=…
- passMXaspmx.l.google.com (priority 1)
- failDNSSECnot signed
Frequently asked questions
Does this modify my DNS?
No. It only performs read-only DNS queries against public authoritative nameservers.
How is the grade calculated?
SPF, DKIM, DMARC and DNSSEC each contribute up to 25 points; MX reachability adds a modifier.
Can I export the report?
Yes — the full scan produces a PDF and JSON export suitable for compliance evidence.
Other free plugins
Ready for the full Domain Security Scan?
Preview mode uses simulated data. Unlock live results, historical trends, exports and API access.