TOOLSET / DNS + EMAIL AUTHENTICATION

Follow the path from DNS to delivery.

A website can resolve while email fails, or publish authentication records that look present but do not work together. Inspect the chain in a deliberate order.

Run a full diagnostic ↘ Use the DNS API →

01 /

Start with authoritative DNS.

Confirm the records and delegation a domain actually publishes before interpreting application-level symptoms.

Use DNS Lookup for raw records and nameserver evidence.
Use DNSSEC Checker to distinguish secure, unsigned, and broken chains.
Use CAA Checker to review certificate-authority policy.

02 /

Trace email authentication as a system.

SPF, DKIM, and DMARC solve different parts of sender authentication. Review them with MX routing so a passing record is not mistaken for a healthy mail configuration.

Verify the servers allowed to send through SPF.
Confirm public DKIM keys exist for the selectors a sender uses.
Inspect DMARC alignment, enforcement, and reporting destinations.
Check MX priority and routing resilience.

03 /

Choose the signal you need.

DNS LookupRaw DNS records and service discovery.↗DNSSEC CheckerValidate the chain of trust.↗MX CheckerMail routing, priority, and redundancy.↗SPF CheckerSender policy and DNS lookup count.↗DKIM CheckerSelector and public-key discovery.↗DMARC CheckerAlignment, policy, and reporting.↗CAA CheckerCertificate-authority authorization.↗

FAQ /

Operational detail.

Which email-security check should I run first?

Start with MX and DNS to confirm routing, then inspect SPF and DKIM before interpreting the DMARC policy that ties authentication to the visible From domain.

Is a published DNSSEC DS record enough?

No. A DS record can be stale or mismatched. Validate the complete chain of trust to distinguish a secure domain from a broken delegation.