DNSTrustCheck

Can someone send email pretending to be you?

DNSTrustCheck scans your domain's DNS and email defenses in one pass — SPF, DKIM, DMARC, BIMI, MX, blacklist status, WHOIS, DNSSEC and more — the same checks that stop scammers from spoofing your address. You get a plain-English health score you can act on, plus an exportable audit PDF.

Last updated: August 30, 2026

Can someone spoof your email?Scan your domain below Did my DNS change go live yet?Check propagation across 12 resolvers Is my site leaking anything sensitive?Run a deep exposure & attack-surface audit

Don't know your DKIM selector? Leave it blank and we'll try common ones automatically.

What this scan actually checks

One scan runs eight checks across DNS and mail delivery, and each result feeds into the weighted health score above.

MX records. MX records tell other mail servers where to deliver mail for a domain. The scan confirms they exist, resolve to real hosts, and aren't left pointing at something that's stopped answering.

SPF (Sender Policy Framework). SPF lists which servers are allowed to send mail for a domain. The scan checks that the record parses correctly and stays under RFC 7208's 10-lookup limit, since going over that limit fails SPF for every message regardless of who actually sent it. Full SPF guide

DKIM (DomainKeys Identified Mail). DKIM signs outgoing mail with a private key so the receiving server can verify it wasn't altered in transit. The scan looks up the public key at the domain's DKIM selector and confirms it publishes cleanly. Full DKIM guide

DMARC. DMARC tells receiving servers what to do when a message fails SPF or DKIM, and where to send reports about it. The scan reads the policy tier, none, quarantine, or reject, since a domain sitting at p=none isn't enforcing anything yet. How DMARC policy should progress

BIMI. BIMI lets a verified logo appear next to a domain's mail in supporting inboxes. The scan checks whether a BIMI record is published and whether DMARC is enforced strictly enough for it to actually activate. Full BIMI guide

Blacklist status. Mail server IPs get checked against active DNSBLs, DNS-based blacklists that mailbox providers consult before accepting a message. A listing on even one reputable blacklist can quietly route a domain's mail straight to spam.

WHOIS. WHOIS surfaces a domain's registrar, creation date, and expiration date. The scan flags a domain that's close to expiring, since an expired domain takes mail and everything else on it down at the same time.

DNSSEC. DNSSEC cryptographically signs DNS responses so a resolver can tell a real answer from a forged one. It's newer and less widely deployed than SPF, DKIM, and DMARC, so the scan checks for it but weights it lighter in the overall score.

Why the scoring works this way

DNSTrustCheck is built and maintained by Gary Thomas, an IT professional with 25 years of experience who needed a fast way to check whether a domain's mail was properly authenticated. Every scan runs live, no cached results, no account required, against public DNS, WHOIS, SMTP, and blacklist infrastructure. The health score weights checks by real-world impact: SPF, DKIM, DMARC, and blacklist status affect deliverability today, so they count for more than emerging standards like DNSSEC and BIMI that fewer providers currently enforce. More about the tool

Frequently asked questions

Is DNSTrustCheck actually free to use?

Yes. No account or sign-up is required for any scan, and every check runs live against public DNS, WHOIS, SMTP and blacklist infrastructure rather than cached data. The site is supported by ads and optional donations, not a paid tier.

Do you store the domains I scan?

No. Submitted domains and email headers are processed server-side to run the scan but aren't retained beyond that session. Standard server logs are kept for security, and the browser stores past results locally only if you choose to compare scans later. See the Privacy Policy for the full breakdown.

What does the health score actually measure?

It's a weighted score, not a simple pass/fail count. Checks with the biggest real-world impact on deliverability and security, SPF, DKIM, DMARC and blacklist status, count for more than emerging standards like DNSSEC and BIMI that fewer mail providers currently enforce.

I don't know my DKIM selector. Can I still run the scan?

Yes. Leave the DKIM selector field blank and the scanner tries a list of common selectors automatically. If none of them match, the report says so, and you can enter the correct one manually once you find it.