Free email authentication tools

Start with the domain health check: it reads SPF, DKIM, DMARC and MX in one pass and scores the result. When one record needs a closer look, the single-record checkers show the detail behind it, and the generators write a corrected SPF or DMARC value for you to paste into DNS, create a new DKIM key pair or write an MTA-STS policy.

The checkers query DNS when you run them, and a result is reused for a few minutes at most, so you see the records receivers see today. The DMARC report analyzer reads the file you upload in memory and keeps nothing. The email header analyzer and the TLS-RPT report analyzer never send your headers or report anywhere: they read them in your browser. The DKIM key generator and the MTA-STS generator also run in your browser: a DKIM private key never reaches us, and the MTA-STS generator sends your domain only if you ask it to look up your MX records. None of the tools asks for an account or an email address.