Email Auth Inspector
Check SPF, DKIM, DMARC, MTA-STS, and BIMI together — one unified grade and a ranked list of fixes.
What is the Email Auth Inspector?
The Email Auth Inspector is an aggregate tool that answers one question about a domain: is it configured to send and receive authenticated email correctly? Rather than checking a single protocol, it evaluates the whole email-authentication stack — SPF, DKIM, DMARC, MTA-STS / TLS-RPT, and BIMI — for the registered domain. Email authentication is a domain-level concern: the path of a URL does not matter, only the registered domain that publishes the DNS records.
HTTPSense runs all five component checks for the domain you enter, normalizes their results into a shared shape, and produces a single A–F grade plus a priority-ranked list of recommended actions. Each component also remains available as its own dedicated inspector if you want to drill into one protocol. The analysis is purely DNS- and HTTPS-based — no email is ever sent.
How to Use the Email Auth Inspector
- Enter a domain name or URL in the search bar and click Inspect Email Auth.
- Read the Verdict tab for the overall grade, the drivers behind it, and the top recommended actions.
- Open the SPF, DKIM, DMARC, MTA-STS, and BIMI tabs to inspect each protocol in detail.
- Use the Recommendations tab for the full ranked list of fixes across every component.
- Use the Raw tab to copy or download the full JSON response.
How the Email Auth Inspector Works
When you submit a domain or URL, we strip the scheme, port, and path to extract the registered domain, then dispatch all five component checks against it. SPF resolves and expands the sending policy and counts it against the 10-lookup limit; DKIM probes a curated set of selectors for public keys; DMARC resolves _dmarc and parses the policy and reporting tags; MTA-STS resolves _mta-sts and fetches the policy file over strict HTTPS to verify the mode and mx coverage; and BIMI resolves the _bimi record and validates the SVG logo and Verified Mark Certificate.
Each component returns its own score and findings. The aggregator combines the component scores using fixed weights — DMARC and SPF carry the most weight, then DKIM, then MTA-STS, with BIMI as an optional bonus — and maps the weighted average to an A–F grade. Components that cannot be reached are excluded rather than penalized, and BIMI never lowers the grade of a domain that has not configured it.
Finally, the findings from every component are merged into a single ranked list of recommendations, de-duplicated and synthesized so cross-cutting issues (such as an enforcing DMARC policy with no aligned SPF or DKIM) surface once, at the top, instead of as several disconnected warnings. We never open an SMTP connection or send mail; the analysis is entirely passive.
Key Features
- Five protocols, one report — SPF, DKIM, DMARC, MTA-STS / TLS-RPT, and BIMI side by side.
- Unified grade — A single weighted A–F score so you know the overall posture at a glance.
- Ranked recommendations — Every finding merged, de-duplicated, and ordered by priority.
- Cross-component synthesis — Dangerous combinations like enforcing DMARC without SPF or DKIM are flagged once, prominently.
- Per-protocol detail — Drill into each component’s record, parsing, and findings.
- Passive and safe — DNS and HTTPS only; no SMTP, no email sent.
- Raw JSON — The full response for scripting and monitoring.
Common Use Cases
- Email administrators — Confirm the full stack is configured before launching a campaign.
- Security engineers — Audit an acquired or unfamiliar domain for impersonation risk in one pass.
- DevOps engineers — Run a pre-deploy posture check after an MX or DNS migration.
- CISOs and auditors — Get a single high-level grade and action list for compliance reviews.
Frequently Asked Questions
What does the Email Auth Inspector check?
It runs five checks against a single domain at once: SPF (the sending policy and its DNS-lookup budget), DKIM (signing keys across common selectors), DMARC (the enforcement policy and reporting addresses), MTA-STS / TLS-RPT (SMTP transport security policy), and BIMI (brand logo and its Verified Mark Certificate). It then combines them into one A–F grade and a ranked list of recommended fixes, so you do not have to run five separate tools.
How is the overall grade calculated?
Each component produces its own 0–100 score. The aggregate weights DMARC and SPF most heavily, then DKIM, then MTA-STS, with BIMI counting only as an optional bonus. The weighted average maps to a letter grade: A is 90 and above, B is 75–89, C is 60–74, D is 45–59, and F is below 45. A component that cannot be reached is treated as “data not available” rather than a penalty, and BIMI is never counted against a domain that has not configured it.
Do I need SPF, DKIM, and DMARC all configured?
Yes — they work together. SPF and DKIM each let a receiver verify that a message is authorized, and DMARC ties those results to the visible From domain and tells receivers what to do when they fail. A common dangerous configuration is an enforcing DMARC policy with no working SPF or DKIM, which causes legitimate mail to be rejected; the Inspector calls this out explicitly as a high-priority recommendation.
Are MTA-STS and BIMI required?
No, but they strengthen your posture. MTA-STS and TLS-RPT protect mail in transit by requiring TLS between sending and receiving servers and reporting failures, while BIMI displays your brand logo next to authenticated mail in supporting inboxes. BIMI in particular requires DMARC at enforcement first. The Inspector reports both, but weights them lightly so their absence does not dominate the grade.
Does this tool send any email?
No. Every check is performed over DNS and HTTPS only — it resolves TXT records, fetches the MTA-STS policy file and BIMI logo and certificate over HTTPS, and never opens an SMTP connection or sends a message. It is completely passive and safe to run against any domain.