Email-security check · public DNS, read just now

mailsigned.com

This is the setup we would put in place. We have nothing to sell you for this domain.

• DMARC: reject

  Providers that honour your policy refuse messages that fail authentication in your name. This is the setting we work towards.

• SPF: present, hard fail

  A list of allowed senders is published. Whether it names every service you use is the first thing we check with you.

• DKIM: key published (cf-bounce)

  A signing key is visible, so at least one service can sign mail in your domain’s name. Whether it is actually signing is shown by a real message, not by DNS.

• Mailboxes: no MX record

  This domain does not receive mail. Protection still matters if anything sends as it.

This is what public DNS shows. It cannot see whether your mailbox is signing, which services send as you, or how providers are treating your mail today. That comes from your own test messages and the providers’ reports, which is where the work starts.