Email authentication
SPF and DMARC presence, policy strength, and visible configuration.
FREE DNS + EMAIL SECURITY TOOLS · FOR MSPS
Free SPF, DKIM & DMARC Checker
Build and review DNS, email-authentication, certificate, browser-protection, and security-contact drafts for an MSP-managed client. The work stays in the browser until the MSP validates, approves, and publishes it through the client’s normal change process.
EVIDENCE · INSIGHT · PROOF
What a domain alone tells you, before the first call.
01
Email authentication
Published SPF, DKIM and DMARC evidence.
02
DNS and certificates
Selected published configuration and records.
03
External surface
Supported public observations, with their dates and limits.
04
Inside the tenant
Not established by public evidence. Ask for approved read-only access.
EVIDENCE · INSIGHT · PROOF
What you can know before they let you in, and after.
01
Before consent
Published domain, DNS, email authentication, certificates and external evidence.
02
With read-only consent
Supported Microsoft 365 identity, app, permission, licensing and configuration evidence.
03
Never inferred
No message bodies, private files, chats or prompts. Unread is not clean.
Check public email-authentication evidence
Use the existing bounded Public Domain Score. Email-authentication configuration alone cannot prove delivery, account compromise or complete spoofing protection.
SCOUTz PROSPECT EVIDENCE · ONE DOMAIN
Build the evidence-backed first look.
Review a prospect or client domain for public-facing email, DNS, certificate, web, and security-contact evidence. Every pass, gap, unread source, and scoring boundary stays visible. See your free result on screen without entering an email address.
5SCORES / UTC DAY
PER IP OR DEVICE
PER IP OR DEVICE
SEE EXACTLY WHAT THE FREE CHECK REVIEWS
Six practical security areas. Fourteen bounded public reads.
A useful first look for the conversation ahead—not a claim about controls hidden inside the business.
DNS trust
DNSKEY and DS reads to determine whether the DNSSEC chain is published.
Certificate authorization
CAA records that name which certificate authorities may issue.
Delegation resilience
Authoritative nameserver delegation and observable redundancy.
Web response protections
One bounded HTTPS homepage read for supported security headers.
Security contact
The RFC 9116 /.well-known/security.txt contact path.
WHAT THE FULL SCOUTz DOMAIN REVIEW ADDS
The public score is the doorway. The domain engine is the building.
The current domain-security workflow schedules 35 collectors and can produce 123 distinct finding types. A collector can execute multiple atomic checks and return evidence, no finding, an unavailable source, or an error; SCOUTz records that distinction instead of turning missing coverage into a pass.
DNS, certificates, and mail
DNS depth, certificate health, SPF, DMARC, DKIM signals, MTA-STS, TLS-RPT, DNSSEC, CAA, delegation, reputation, and IPv6 mail-path context.
External web surface
Subdomains, takeover signals, TLS posture, response headers, website compliance, CMS and technology fingerprints, and public-facing hardening context.
Brand and exposure
Lookalike domains, impersonation signals, source-labeled historical breach associations, outside-in perimeter context, and supported public-exposure evidence.
Cloud doorstep
Public Microsoft 365 tenant discovery, managed-versus-federated identity signals, and the evidence boundary for requesting a customer-approved cloud review.
Technology and providers
Hosting, email-security, SaaS, telecom/UC, platform, vendor, and incumbent-management signals derived from public records and fingerprints.
Business context
Firmographic, entity, mobile-app, digital-presence, compliance-readiness, and public AI-governance signals that help an MSP prepare the right conversation.
Frequently asked questions
How do I check SPF, DKIM and DMARC?
Start with the domain’s public email-authentication evidence. Review SPF senders, DMARC policy and alignment, and the DKIM selector supplied by your mail provider. An unknown selector is not proof that DKIM is absent.
What is a good DMARC policy?
An appropriate policy follows an inventory of legitimate senders and alignment testing. Move toward enforcement through the authorized change process; a published reject policy alone does not prove complete spoofing protection.
Why does my domain fail DMARC?
A message fails when neither its SPF nor DKIM result passes with the required alignment. A DNS-only review cannot establish every message’s authentication result; inspect authorized message headers and reports.
Is this checker free?
The bounded public score is free and its result is visible without signup. Website safeguards still apply. Local fix generators prepare drafts; they do not publish changes.
What are SCOUTz Domain Tools?
They are browser-based fix-preparation utilities for MSPs: generate a draft, review text pasted by the operator, and plan a safe client rollout. Work stays local to the page. Publishing and final validation remain inside the MSP’s authorized client change process.
No agent. No tenant consent. No pretending.
The domain view uses the public evidence available before a customer authorizes deeper access. It can support an informed question about domain, DNS, email, certificate, web, and related external posture. It cannot establish internal identity, application, device, sharing, licensing, recovery, or operational controls.
Why the first review stays outside-in →Why does SCOUTz offer the fix tools as a courtesy?
Because a finding without a useful next step is theater. These ungated tools help an MSP understand the control, prepare a draft, and explain the rollout without touching the domain or consuming the production review workflow. The MSP and client still own authorization, validation, publication, and rollback.
Start with the factual public score →
Generate
Prepare SPF, DMARC, DKIM, MTA-STS, TLS-RPT, CAA, DANE/TLSA, BIMI, security-header, CSP, and security.txt drafts.
Review locally
Paste an SPF or DMARC record to flag common formatting and policy considerations without looking up the domain.
Plan rollout
Carry a copy-ready draft into the MSP’s normal approval, publication, rollback, and validation workflow.
Your next prospect meeting is already on the calendar.
Bring dated evidence, clear limits, and useful questions.