How to use the workspace
- Enter the email domain, not an entire email address.
- If you have a DKIM-Signature header, copy its s= selector into the optional selector field. Leave it empty rather than guessing.
- Submit and review the independent SPF, DMARC and DKIM status sections. Read all limitations and unresolved dependencies.
A concrete starting point
Domain: example.com DKIM selector: selector1 (only if known) DKIM owner: selector1._domainkey.example.com
This shows how a selector names a DNS key location; it does not assert that this example publishes that key.
Read the result carefully
Present, absent, invalid and indeterminate have different meanings. DMARC organizational-domain fallback is shown explicitly. SPF lookup count is the exploration budget consumed, not proof that a sender evaluation satisfies the RFC ten-term limit.
Common mistakes to avoid
- A present DKIM key is not a verified signature.
- SPF macros and unvisited dependencies can prevent a complete static exploration.
- A strict DMARC policy does not prove every receiving system enforces it.
Limits & privacy
DNS records only, with a 32-query budget, bounded dependency depth and a 10-second API deadline. No selector enumeration or sender authentication.
Live: sends the submitted target for inspection
Open Email DNS Policy →The target is sent to the diagnostics API and its resolver or inspected server. Do not submit confidential targets.
Read the full privacy boundaries