Step-by-step guides for xteam's free email security tools.
MailCheck runs up to 13 simultaneous checks on a domain's email security configuration — instantly, with no account required.
yourbusiness.co.nz) — no http:// or www neededgoogle, selector1)| Check | What it looks for | Why it matters |
|---|---|---|
| MX Records | Mail server hostnames and their IPs | Without MX records, no one can send email to your domain |
| SPF | v=spf1 TXT record — which servers are allowed to send as you | Prevents unauthorised servers from sending email pretending to be your domain |
| SPF Chain | Follows all include: directives to check lookup count | More than 10 DNS lookups causes SPF permerror, breaking authentication |
| DMARC | v=DMARC1 policy record — what to do with failing mail | Tells receiving servers to quarantine or reject mail that fails SPF and DKIM |
| DKIM | Public key TXT records for common and detected selectors | Cryptographic signature proving email was not tampered with in transit |
| BIMI | Brand logo record for Gmail/Apple Mail inbox display | Shows your verified logo in email clients — requires p=quarantine or reject DMARC |
| MTA-STS | Policy file mandating TLS on inbound connections | Prevents downgrade attacks — forces senders to use TLS to your mail server |
| DANE/TLSA | TLS certificate fingerprint pinned in DNS | Advanced TLS validation — pins your mail server certificate to DNS |
| Blacklists | IP checked against 15+ RBL spam databases | Being listed blocks your outbound mail at many receiving servers |
| SMTP | Connects to MX hosts and checks TLS version/cert | Verifies your mail server accepts connections and has a valid certificate |
| Open Relay | Attempts to relay mail through your server | Open relays are immediately exploited by spammers — critical to fix |
| WHOIS | Domain registration and expiry information | Expired domains are seized — check your renewal dates |
| IP Reputation | Checks MX IPs against abuse databases | Shared hosting IPs often carry bad reputation from previous tenants |
Each check contributes to an overall security score out of 100:
After running a full check, use the Export PDF button to download a printable report — useful for sharing with your IT team or provider.
Mail providers such as Gmail, Outlook, and Yahoo send you daily DMARC aggregate reports showing who sent email on behalf of your domain and whether it passed authentication. This tool parses those reports and turns the raw XML into an actionable summary.
Reports are processed in memory and immediately discarded. Nothing is saved to our servers.
.xml — plain aggregate report XML (RFC 7489).xml.gz — gzip-compressed XML (most providers — Gmail, Outlook, Yahoo).zip — ZIP archive containing an XML fileMaximum file size: 5 MB. You do not need to decompress the file first — the tool handles it automatically.
Percentage of messages that passed DMARC — either SPF or DKIM aligned. Aim for 95%+ before tightening policy.
Every IP address that sent email using your domain, grouped by provider (Google, Outlook, SendGrid, etc.), with individual pass/fail counts for DKIM and SPF.
Prioritised action items based on your report data and live DNS settings — from policy upgrade readiness to specific failing sources that need investigation.
Your current SPF and DMARC records fetched at analysis time, so you can compare them against what the report shows.
p=none → p=quarantine → p=reject. Aim for reject once your pass rate consistently exceeds 95%
DMARC aggregate reports are emailed to the address in your rua= tag daily. If you haven't set up a rua= address yet, you won't receive reports — add one to your DMARC record first.
Run a MailCheck scan for your domain and look at the DMARC result. Your record should look something like:
v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.co.nz; pct=100
If your record has no rua= tag, add one. The email address can be your own inbox or a dedicated mailbox.
Reports arrive as email attachments from major mail providers — typically daily, covering the previous 24-hour UTC period:
noreply-dmarc-support@google.com, attached as .xml.gzdmarcreport@microsoft.com, attached as .xml.gz or .zippostmaster@yahoo.com, attached as .xml.gzSave the attachment to your computer, then upload it to the DMARC Analyzer.
Google sends reports daily and covers a high volume of email — it's usually the most informative report to start with.
A DNS TXT record listing which mail servers are authorised to send email for your domain. Receiving servers check this to detect spoofing.
A DNS policy record that tells receiving servers what to do with mail that fails SPF and/or DKIM — none (monitor), quarantine (spam folder), or reject. Also enables aggregate reports.
A cryptographic signature added to outgoing email by your mail server, verified by the recipient using a public key published in DNS. Proves the email was not altered in transit.
A DNS record pointing to your verified brand logo. Gmail and Apple Mail display the logo in the inbox if your DMARC policy is quarantine or reject and you hold a VMC certificate.
A policy file hosted at https://mta-sts.yourdomain.co.nz/.well-known/mta-sts.txt that forces sending servers to use TLS when delivering to you — prevents downgrade attacks.
Advanced certificate pinning using TLSA records in DNS — pins your mail server certificate directly so it cannot be substituted by a rogue CA.
For DMARC to pass via SPF, the RFC5321 envelope-from domain must match (or be a subdomain of) the From: header domain.
For DMARC to pass via DKIM, the DKIM d= signing domain must match (or be a subdomain of) the From: header domain.
DMARC monitoring mode — reports are collected but failing mail is not filtered. Use this to understand your traffic before enforcing.
Failing mail is sent to the spam/junk folder. A good intermediate step.
Failing mail is rejected outright. Maximum protection — only safe once your pass rate is consistently high.
The percentage of mail the DMARC policy is applied to. Start at a low value (e.g. pct=10) when tightening policy, then increase toward 100.
The email address that receives DMARC aggregate reports. Add rua=mailto:youraddress to start receiving daily reports.
A database of IP addresses known to send spam. Mail servers check these lists before accepting email — if your IP is listed, delivery is blocked.
Run a free scan in under 30 seconds — no account needed.