Skip to content
Emergency helpGet started

What is an email security check?

An email security check inspects the public DNS records that control whether receiving mail servers trust messages claiming to come from your domain. Vigilbase checks SPF, DKIM, DMARC, MX, DNSSEC, MTA-STS, TLS-RPT and BIMI, then returns an A+ to F grade with the DNS changes to make.

Agents can run the same non-intrusive scan via POST https://api.vigilbase.com/tools/v1/agent/tools/email-security/execute.

What this email security test checks

The check looks up eight kinds of public DNS record for the domain, plus the MTA-STS policy file. It does not send mail, read mailboxes or change DNS. Each record is scored out of 100, then weighted by how much it protects the domain from spoofing.

DMARC

Weight: 25/100

Tells receiving servers what to do with mail that fails SPF and DKIM alignment, and where to send reports.

Lookup: _dmarc.example.com TXT

p=reject earns full credit. p=none costs the most, p=quarantine a little; pct below 100, no rua report address and a weaker sp= subdomain policy also cost points.

SPF

Weight: 20/100

Lists the servers allowed to send mail for the domain.

Lookup: example.com TXT (v=spf1)

-all earns full credit and ~all slightly less. +all, ?all, more than one SPF record, more than 7 DNS-lookup mechanisms (10 is the limit) and the deprecated ptr mechanism cost points.

DKIM

Weight: 15/100

Publishes the public keys receivers use to verify message signatures.

Lookup: <selector>._domainkey.example.com TXT

Passes when a key is found under one of 14 common selectors, such as google, selector1, selector2, default and k1. A key under a custom selector is not discovered and is reported as missing.

MX

Weight: 10/100

Names the servers that receive mail for the domain.

Lookup: example.com MX

A single MX record, an invalid exchange or an MX that points to an IP address instead of a hostname costs points.

DNSSEC

Weight: 10/100

Signs DNS answers so resolvers can detect forged records, including mail records.

Lookup: example.com A (DNSSEC-validated)

Full credit when a validating resolver authenticates the answer; half credit when the status cannot be verified.

MTA-STS

Weight: 10/100

Requires sending servers to deliver to your MX over verified TLS.

Lookup: _mta-sts.example.com TXT + https://mta-sts.example.com/.well-known/mta-sts.txt

A policy in enforce mode earns full credit, testing mode partial credit and none mode less. A TXT record without a reachable policy file scores low.

TLS-RPT

Weight: 5/100

Asks sending servers to report TLS delivery failures to you.

Lookup: _smtp._tls.example.com TXT

A record without a rua reporting address earns half credit.

BIMI

Weight: 5/100

Points supporting mail clients to your brand logo. It is optional.

Lookup: default._bimi.example.com TXT

Loses points without an l= logo URL or an a= Verified Mark Certificate.

How the A+ to F grade works

The weighted record scores add up to a total out of 100, and a missing record scores zero for its share. A high grade means the published records match this baseline at scan time; review DMARC reports before tightening policy so legitimate senders are not rejected.

A+
90-100
A
80-89
B
65-79
C
50-64
D
35-49
F
0-34

Beyond DNS records

These records stop other people sending mail as your exact domain. They do not stop phishing from lookalike domains or from compromised accounts, which send authenticated mail. Vigilbase OS connects the security tools you already pay for, including Microsoft 365, Google Workspace, Proofpoint and Mimecast. The Vigil agent investigates high-severity incidents and Vigilbase analysts handle exceptions.

Managed SOCGet started
Questions

Email security check FAQ

What does the Vigilbase Email Security Analyzer check?

It inspects public DNS email authentication records for a domain, including SPF, DKIM, DMARC, MX, DNSSEC, MTA-STS, TLS-RPT, and BIMI, then returns an A-F grade with remediation guidance.This is a public DNS configuration check, not a mailbox audit or a test of every message you send. Review each finding against the actual mail providers and sending services in use.About email authenticationCompare the public security checks

Is the Email Security Analyzer free?

Yes. The public tool is free to use for checking a domain's email authentication posture. No Vigilbase account is required to run a scan.The analysis reads public DNS information. Optional emailed reports and intrusive website tools have their own access and verification requirements.Compare the public security checksTool access and verification requirements

Why do SPF, DKIM, and DMARC matter?

Together they help receiving mail servers verify that messages claiming to come from your domain are authorized. Misconfigured or missing records make spoofing and phishing easier and can hurt deliverability.Inventory all legitimate senders before tightening policy. Check authentication alignment and reporting with your mail administrator so a protective change does not reject legitimate mail.About email authenticationRun a check through the public API

How is the email security grade calculated?

Each record is scored out of 100 and weighted: DMARC counts for 25 points, SPF for 20, DKIM for 15, MX, DNSSEC and MTA-STS for 10 each, and TLS-RPT and BIMI for 5 each. The weighted total maps to A+ (90 or more), A (80), B (65), C (50), D (35) or F.A missing record scores zero for its share. DMARC with p=reject, a single SPF record ending in -all and a discoverable DKIM key carry most of the grade.About email authenticationCompare the public security checks

Why does the check report DKIM as missing when my domain signs mail?

DKIM keys are published under a selector that only appears in signed message headers, so a DNS check has to guess it. Vigilbase tries 14 common selectors, including google, selector1, selector2, default, k1 and s1. A key under a custom selector is not found and is reported as missing.Find your selector in the DKIM-Signature header (the s= tag) of a message you sent, then confirm that selector's record with your mail provider.About email authenticationRun a check through the public API

Can agents run this scan autonomously?

Yes. Agents can POST {"target":"example.com"} to https://api.vigilbase.com/tools/v1/agent/tools/email-security/execute without Turnstile (optional developer API key from https://one.vigilbase.com/developers). See https://docs.vigilbase.com/tools/developers. The browser UI remains available for interactive use.The API inspects public records and does not modify DNS or access mailbox content. Follow the documented request format and rate limits when automating checks.Run a check through the public APIAPI authentication and rate limits

Can I use the report to fix my mail setup?

Yes. The report highlights failing or weak controls and recommends concrete DNS changes for mail administrators. Review each recommendation against your mail provider’s configuration before applying it.Identify the owner of each DNS record and the affected sending service. Apply changes through the appropriate provider, allow for DNS propagation, then rerun the check and review mail authentication results.About email authenticationDiscuss your scope with Vigilbase