Email & DNS Security Tools: SPF, DMARC, DKIM and Mail Diagnostics

Mail is still where most attacks start. And the records that protect it? They live in DNS, where nobody looks until something’s already on fire. These are the checks I reach for when a domain suddenly can’t send, or when I’m bolting one shut so nobody can spoof it. SPF and DKIM. DMARC sitting on top. Your MX. Plus a quick look at whether your address is already floating around in some breach.

SPF Record GeneratorBuild a valid v=spf1 record from provider presets, with a live counter that keeps you honest against the 10-lookup limit before it bites.DMARC Record GeneratorBuild a DMARC record with the right p=, rua and pct values, plus plain guidance on when to use none, quarantine or reject.DKIM Record GeneratorTurn a public key into the exact selector._domainkey TXT record. It handles the 255-char chunking for you, and there’s a lab keygen if you need one.SPF Record CheckerReads your SPF line and tells you who you’ve actually green-lit to send mail. It also flags whether you’ve blown past that 10-lookup ceiling, the one nobody mentions until it quietly breaks everything.DMARC Record CheckerShows your policy and where your reports end up. Still parked on p=none, doing precisely nothing? You’ll see that too. Look here first, before you ever touch quarantine or reject.DKIM LookupHand it the selector and the domain. It yanks the public key straight out of DNS, so you can see for yourself the signing key is genuinely published and not just half-configured.Email DNS Health CheckerAll four in one glance: MX, SPF, DMARC, DKIM. Honestly, this is the tab I open first whenever someone slacks me “our email just stopped working.”Breach-Safe Email CheckerA fast gut-check on an address. Has it surfaced in a known leak? And if so, what’s worth locking down next? Straight answers. No scare tactics, I promise.

Email DNS and account safety

Most people skip this part. These three aren’t separate boxes to tick off and forget. SPF says which servers are allowed to send for you. DKIM then signs the message so it can’t be quietly tampered with on the way over. DMARC is the one that ties those two together and tells the receiving server what to do when a message flunks both checks. Get any one of them wrong and the others can’t really cover for it. Which is exactly why I’d rather check them as a set than poke at them one at a time. Maybe that’s just paranoia talking, honestly, but I’ve been burned by a “fixed” SPF that left DMARC wide open, so.

Cyber Privacy Tools DNS Lookup Security Headers Checker