Domain Security Scanner
Scan the security records an inbox grade does not cover: BIMI, MTA-STS, TLS-RPT, and MX, alongside SPF, DKIM, and DMARC.
Want an inbox placement grade instead? Use the email deliverability checker.
Why Fixing One Record Isn't Enough
SPF
Lists authorized sending servers. Prevents spoofing from unauthorized IPs.
DKIM
Adds a cryptographic signature to outgoing emails, proving they haven't been tampered with in transit.
DMARC
Tells receiving servers what to do with emails that fail SPF/DKIM. Enables reporting and enforcement.
BIMI
Displays your brand logo next to emails in supported inboxes. Requires a valid DMARC policy.
MTA-STS
Enforces TLS encryption for incoming mail, preventing downgrade attacks and eavesdropping.
TLS-RPT
Provides reporting on TLS connection failures, helping you identify encryption issues.
MX Records
Specifies which mail servers handle incoming email for your domain.
A Records
Maps your domain to an IP address. Essential for web and mail server resolution.
NS Records
Identifies your authoritative name servers, the foundation of your DNS infrastructure.
What a Domain Security Scan Checks
A domain security scan reads the public DNS records published for your domain and grades how well mail from and to it is authenticated and encrypted. As a domain analyzer for email, it shows in one pass which of SPF, DKIM, DMARC, BIMI, MTA-STS, TLS-RPT and MX are present and which are missing. This free domain scanner needs no account.
As a domain name scanner, it takes the bare domain name, such as example.com, without https:// or www. Domain scanning here is DNS-level only: the tool looks up records and does not log in to a mail server or send a test message. A domain security check like this is a good first step before a launch, a new ESP or a DMARC policy change; for inbox placement results, use the email deliverability checker.
Related Free Tools
Learn More
Why We Built This Tool
Most brands fix one authentication problem at a time and miss the five others. A domain might pass SPF but fail DMARC alignment, or have BIMI but no MTA-STS. This scanner checks all seven authentication protocols simultaneously — grading your overall security posture.
What Goes Wrong Without This
Individual protocol checks are incomplete. You could fix SPF, DKIM, and DMARC but still fail Gmail and Yahoo's 2024 bulk sender requirements, which now mandate DMARC enforcement AND one-click unsubscribe headers. A complete audit catches all gaps at once.
Who This Tool Is For
E-commerce & DTC Brands
Teams managing sending from multiple ESPs and subdomains who need visibility into which authentication protocols are live and which are missing.
Email Marketing Agencies
Agencies auditing client email security posture and needing to identify which domains require immediate fixes before campaigns launch.
B2B SaaS & Outbound Teams
DevOps and security teams responsible for email infrastructure who need to track authentication coverage and compliance with Gmail/Yahoo 2024 bulk sender requirements.
Frequently Asked Questions
What does the security score mean?
Can I improve my score without changing all my records?
Why scan multiple times?
What is a domain security scan?
Is this domain security check the same as an inbox placement test?
Is there a free domain scanner for email authentication?
How do I run a domain scan for email security?
Do I need an InboxEagle account to use this tool?
Your Security Score Will Change. You Need to Know When.
This scanner is a free one-off check. InboxEagle checks your SPF, DKIM, MX and DMARC policy records every 24 hours and alerts you on any change. It does not monitor BIMI, MTA-STS or TLS-RPT. Used by email agencies managing 50+ client domains.
Start Free 14-Day Trial14-day free trial · No credit card · Cancel anytime