Disposable email Tools
Updated 29 October 2026
Without SPF, DKIM and DMARC, anyone can send emails that appear to come from your domain. Enter a domain or an address: the tool reads its public configuration and tells you exactly what to fix.
When an email arrives, the recipient's mail provider looks up the DNS of the sender's domain to find out whether it is genuine. The tool reads exactly the same public records:
| Record | Where it lives | What it does |
|---|---|---|
| MX | example.com | Lists the servers that receive mail for the domain |
| SPF | TXT on example.com | Lists the servers allowed to send on behalf of the domain |
| DKIM | TXT on selector._domainkey.example.com | Publishes the key that verifies message signatures |
| DMARC | TXT on _dmarc.example.com | Says what to do with a message that fails, and where to send reports |
| MTA-STS | TXT on _mta-sts.example.com | Enforces encryption for incoming mail (optional) |
| BIMI | TXT on default._bimi.example.com | Shows the brand logo in some mail apps (optional) |
The score out of 100 sums up the protection. SPF and above all DMARC carry the most weight, because they are what stop spoofing. MTA-STS and BIMI are bonuses. DKIM only counts if a key is found or if you enter a selector.
Each provider publishes its DKIM key under a name of its choice, the selector: google for Google Workspace, selector1 and selector2 for Microsoft 365, others elsewhere. DNS does not allow these names to be listed. The tool tries the most common ones; if it finds nothing, that does not prove DKIM is missing.
To find your selector, open an email sent from your domain, display its headers and look for the DKIM-Signature line: the value after s= is the selector, the one after d= is the signing domain. The Boxo email header analyzer helps you read them.
The email protocol lets anyone write any address in the "From" field. Without authentication, a scammer can send fake invoices or fake password messages that seem to come from your company. Your customers are the victims, and so is your reputation.
Delivery is the other issue. Since 2024, Gmail and Yahoo have required bulk senders to authenticate their messages with SPF, DKIM and DMARC. Even for a small domain, a missing or broken SPF record often sends legitimate messages to spam.
~all. The records suggested by the tool are a starting point to adapt.p=none** and a rua address, and read the reports for a few weeks.p=quarantine, then p=reject** once all your legitimate mail passes.A domain that never sends email, such as a name kept to protect a brand, should be locked down too: v=spf1 -all and v=DMARC1; p=reject;. Otherwise it remains an ideal target for spoofing, precisely because nobody is watching it.
DNS changes take anywhere from a few minutes to a few hours to become visible. Run the analysis again afterwards to check.
No. It only reads public DNS records, the same ones any mail provider looks up when an email arrives. No message is sent.
Both are fine once DMARC is in force. "~all" is more forgiving during setup, in case a sending service was forgotten. Once all your senders are listed, "-all" is stricter.
It is published under a selector chosen by your provider, and DNS does not allow selectors to be listed. Enter it in the field provided: it appears after "s=" in the DKIM-Signature header of an email sent from your domain.
Yes, if one of your sending services is not authorized by SPF or signed with DKIM. That is why you should start with "p=none" and read the reports before tightening the policy.