Email authentication misconfigurations — missing SPF records, absent DMARC policies, and incorrect DKIM signatures — let attackers send email from your domain without authorization. Across the 700-plus AI-built apps Launch Ready Code has scanned, email authentication is absent or misconfigured on the majority of domains, making phishing and domain spoofing trivially easy. This tool checks your domain's SPF, DMARC, MX, and DKIM setup in under ten seconds and tells you exactly what to fix.
The vulnerabilities described here align with the OWASP Top 10, the industry-standard list of the most critical web security risks, and MITRE CWE Top 25. Severity uses CVSS v3 scoring from NIST's National Vulnerability Database.
Enter a domain to check its SPF, DMARC, and MX records. Misconfigured email lets attackers spoof your domain and phish your users. Runs a real DNS-over-HTTPS lookup — nothing is stored.
_dmarc.[domain] and evaluates the enforcement level (p=none, quarantine, or reject)Example: try google.com or your own domain.
Standards reference: SPF is defined in RFC 7208; DMARC in RFC 7489. NIST SP 800-177 recommends SPF + DMARC as baseline email authentication for all organizations. Missing DMARC is classified as a CWE-284 (Improper Access Control) vector by OWASP.
Your app may also be leaking API keys, missing row-level security, or running with no error tracking. Get the full Launch Readiness Score in ~60 seconds.
Get my free scoreEmail authentication standards prevent attackers from sending email that appears to come from your domain. SPF (Sender Policy Framework) is a DNS record that lists the IP addresses authorized to send email on your behalf. DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing mail so recipients can verify it hasn't been tampered with. DMARC ties both together, telling receiving mail servers what to do when a message fails SPF or DKIM — reject it, quarantine it, or let it through.
Without these records, anyone can send an email claiming to be from your domain. This is called domain spoofing, and it's the mechanism behind most phishing and business email compromise (BEC) attacks. Google and Yahoo began requiring DMARC compliance for bulk senders in 2024, and Microsoft announced similar requirements for 2025.
AI-built apps frequently send transactional email (welcome emails, password resets, invoices) via third-party providers like Resend, SendGrid, or Postmark without configuring the necessary DNS records. The provider sends the mail, but without SPF authorization or DKIM signing for the custom domain, major inbox providers may quarantine or reject the messages.
A weak or missing DMARC policy (p=none) provides no protection — it only monitors without enforcing. For production SaaS apps, the target is p=reject or p=quarantine with a 100% rollout percentage. Missing MX records on a sending domain indicate the domain has no configured mail infrastructure, which itself raises spam flags.
An A grade means all three records are correctly configured and your DMARC policy is enforced (p=reject or p=quarantine). A B or C grade typically means DMARC is present but set to p=none, or SPF includes too many mechanisms (10-lookup limit). An F grade means one or more critical records are missing. The most important fix is always DMARC — without it, SPF and DKIM passing means nothing defensively.