Email Security Grader - SPF, DMARC, DKIM, MTA-STS (Bulk)
Pricing
Pay per event + usage
Email Security Grader - SPF, DMARC, DKIM, MTA-STS (Bulk)
Grade any domain A-F on email security: SPF, DMARC, DKIM, MTA-STS, TLS-RPT and BIMI, with a spoofable flag and the exact fixes. Bulk and cheap: leads for MSPs and security teams.
Pricing
Pay per event + usage
Rating
0.0
(0)
Developer
Musedenny
Maintained by CommunityActor stats
0
Bookmarked
2
Total users
1
Monthly active users
2 days ago
Last modified
Categories
Security
Limited permissionsShare
Email Security Grader – SPF, DMARC, DKIM, MTA-STS (Bulk)
Grade any domain A–F on email security from its public DNS, in bulk. Each result says whether the domain is spoofable (anyone can send email as it), lists every issue, and gives the exact fix. MSPs, security consultants and email deliverability agencies use it to find prospects and to report on clients.
Checks
| Check | What's graded |
|---|---|
| SPF | Present, only one record, ends in -all/~all (not +all/?all), within the 10-DNS-lookup limit (includes followed) |
| DMARC | Present, policy none / quarantine / reject, pct, reports (rua) |
| DKIM | Keys on 27 common selectors (Google, Microsoft, SendGrid, Mailchimp, Zendesk, HubSpot…). Wildcard DNS is detected so results aren't faked |
| MTA-STS | Record plus the live policy file (mode: enforce) |
| TLS-RPT, BIMI | Present |
Domains that send no email (null MX, v=spf1 -all) are graded on lock-down, not on DKIM.
Input
| Field | Default | Meaning |
|---|---|---|
domains | – | Domains, URLs or email addresses |
onlyGradesAtOrBelow | – | Lead mode: e.g. C outputs only C, D and F |
onlySpoofable | false | Only domains anyone can spoof |
maxDomains | 10000 | Cap per run |
Output
{"domain": "weak.com", "grade": "F", "score": 30, "spoofable": true,"issues": ["Multiple SPF records (invalid)", "SPF allows everyone (+all)", "No DMARC record", "…"],"fixes": ["Merge the SPF records into one…", "End the SPF record with -all…", "Publish \"v=DMARC1; p=none; rua=mailto:dmarc@weak.com\" at _dmarc.weak.com…"],"spf": {"record": "v=spf1 +all", "count": 2, "all": "+all", "lookups": 0},"dmarc": {"record": null, "policy": null, "pct": null, "reports": false},"dkim": {"selectorsFound": [], "selectorsChecked": 27, "wildcardDns": false},"mtaSts": {"record": false, "mode": null}, "tlsRpt": false, "bimi": false, "hasMx": true, "mx": ["mx.weak.com"]}
Pricing (pay per event)
$0.001 per run and $0.0015 per domain: 1,000 domains for $1.50.
DNS-over-HTTPS lookups (Cloudflare, Google fallback). No email is sent, and the mail servers are never contacted.