Skip to content
EN
Seal my domain

The X-ray

Check your domain’s DMARC, SPF and DKIM

Type your domain and you will see what any mailbox can check about you from outside the moment an email from you arrives. We do not ask for your email address or install anything.

Type the domain only. If you paste an email address or a URL, we keep just the domain.

Public DNS lookups only · 20 seconds · no sign-up

Fromfacturas@empresa.example

Toyour customer

  • The senderSPF: In order
  • The wax sealDKIM: Not visible from outside
  • The standing orderDMARC: Missing

Return to sender

Sample envelope, with an invented domain.

What we look at, exactly

It is all public information: you can repeat every lookup yourself with dig, and the result gives you the command.

IdentityDoes your email say who you are?
SPF and DKIM: which servers may send in your name, counting the lookups for real, and whether your messages go out signed.
PolicyWhat are you asking the mailbox to do?
DMARC: the order, who it applies to and whether you are receiving the reports.
TransportHow does it travel and how does it reach you?
MX, MTA-STS and TLS-RPT: whether you can receive, whether what reaches you travels encrypted and whether you find out when it fails.
Public reputationAre you showing your brand?
BIMI, if you have it published. It is informational: it does not score.
HygieneIs the domain tidy?
Leftovers from providers you no longer use and obsolete records, which is what breaks an SPF most silently.

The rules of this tool

  • What cannot be checked shows in grey, never red

    We do not know whether you land in the junk folder or what your reputation is at Gmail. Nobody can know that from outside.

  • No record is not the same as being unable to ask

    If the DNS answers and there is no record, we can say so. If the DNS fails or is slow, we do not know, and that is what you will see written.

  • The result is not published

    It lives at an address that cannot be guessed, no search engine indexes it and it is deleted after 30 days.

  • One domain at a time

    Five checks an hour and twenty a day per person. There is no batch mode or API: this is not a scanner for other people’s domains.