Frequently asked questions

Yes. Domain Check is a free tool from the SF2i group, with no sign-up and no account. You can check as many domains as you need and save the PDF report.

No. The analysis runs in your browser, using the domain's public DNS data. The domain you enter is only sent to the public DNS resolvers of Cloudflare and, as a fallback, Google: SF2i does not receive it and keeps nothing. The site sets no cookies and uses no local storage or audience measurement.

Five points, the ones every server that receives an email in your name looks at: the mail servers (MX), the list of servers allowed to send (SPF), the signature on your emails (DKIM), the anti-spoofing policy (DMARC) and whether your mail IP addresses appear on five public blacklists. For each point, it explains the finding and, where possible, offers the corrected DNS record, ready to copy.

Each check receives a score out of 100. The overall score is their weighted average: DMARC 30, SPF 25, DKIM 25, MX 10 and blacklists 10. An SPF record ending in +all or a blacklisted IP address caps the score at 49. A point that cannot be verified is left out of the calculation, and the score is then flagged as partial. A score of 80 or more is good, 50 to 79 needs improvement and below 50 is critical. Every rule is set out in detail on the Method page.

A DKIM key is published under a name chosen by your provider, the selector, and DNS offers no way to list a domain's selectors. Domain Check tests 57 of the most common ones. If none matches and your provider assigns a selector specific to each customer, as OVHcloud or Amazon SES do, the tool cannot reach a conclusion: DKIM is left out of the score rather than counted as missing. Enter your selector in the "Custom selector" field of the result to check it. DKIM is also not verifiable when DNS does not respond.

The selector is the name of your DKIM key: the key is published at <selector>._domainkey.<your domain>. To find it, open an email you have sent and display its source ("Show original" in Gmail, the message properties or source in Outlook). In the DKIM-Signature header, the s= value is the selector and d= the signing domain. Microsoft 365 uses selector1 and selector2, Google Workspace uses google.

Yes, that is the goal: only p=reject gets emails that spoof your domain refused. But not straight away. Start with p=none and a report address (rua), use the reports to identify every service that sends in your name and fix its SPF or DKIM, then move to p=quarantine and finally to p=reject. Allow a few weeks. A domain that sends no email can go straight to p=reject.

-all asks recipients to reject unauthorised servers, ~all only to mark them as suspicious. Once all your sending services are listed in the SPF record, -all is the recommended ending. With a DMARC p=reject policy applied to all emails, ~all is enough: DMARC is what gets spoofed emails rejected, and Domain Check then also gives SPF the maximum score. Without DMARC set to reject, ~all scores 80 out of 100. Never use +all or ?all.

Declare it, otherwise it can still be used to impersonate you. Publish an SPF record v=spf1 -all on the domain and a DMARC record v=DMARC1; p=reject; on the _dmarc name. If it does not receive email either, publish a null MX: a single MX record, with priority 0, pointing to the target ".". Domain Check recognises this profile: DKIM and blacklists then do not apply.

First find the cause: a hacked email account, an infected computer, a hijacked website form or a misconfigured server. Fix it, then request removal of the address on the website of the list concerned; without a fix, it will be listed again. As long as an address is listed, Domain Check caps the overall score at 49. The shared addresses of recognised providers (suites such as Microsoft 365 or Google Workspace, hosting providers such as OVHcloud, filtering gateways, local operators such as Lagoon) are not tested: their reputation is managed by the provider.

Spamhaus refuses queries that go through public DNS resolvers, which are the ones Domain Check uses from your browser. Cloudflare returns an error code, and Google a response that wrongly looks like "not listed": the result would be misleading. Its free use is, moreover, restricted to non-commercial purposes. Domain Check queries five other public lists, SpamCop, PSBL, UCEPROTECT level 1, DroneBL and 0spam, each one checked before use through its test entry.

Usually from a few minutes to a few hours. Each record has a cache lifetime, the TTL: until it has expired, resolvers, including the Cloudflare and Google resolvers that Domain Check uses, may still serve the old value. Allow at least the length of the old TTL, often one hour; some DNS hosts quote up to 48 hours. Then run the analysis again.

Yes. SF2i helps organisations in New Caledonia, French Polynesia and France secure their email: SPF, DKIM, DMARC, a gradual move to p=reject and report monitoring. Write to us using the contact form. After an analysis, the "Contact SF2i" button opens this form with a summary of your result.