Check the modern email-security records that most tools skip: MTA-STS (forces encrypted SMTP delivery), TLS-RPT (reports on TLS delivery failures), and BIMI (shows your verified brand logo in the inbox). These sit on top of SPF, DKIM, and DMARC to harden email in transit and build trust in the inbox.
Most email security tools stop at SPF, DKIM, and DMARC, but there is a newer layer that protects mail in transit and builds trust in the inbox. MTA-STS tells other mail servers they must deliver to your domain over encrypted TLS with a valid certificate, closing the door on downgrade and man-in-the-middle attacks that plain SMTP allows. TLS-RPT asks those servers to send you daily reports about TLS delivery, so you can spot certificate problems and downgrade attempts before they cause outages. BIMI displays your verified brand logo next to your messages in supporting inboxes like Gmail and Apple Mail. This tool checks all three records for any domain, explains what it finds in plain English, and gives you copy-paste examples to fix whatever is missing.
Enter a domain name and click Check Email Security. The tool looks up the MTA-STS TXT record at _mta-sts.yourdomain.com and then fetches the matching policy file over HTTPS to confirm it is actually enforceable, reads the TLS-RPT record at _smtp._tls.yourdomain.com, and reads the BIMI record at default._bimi.yourdomain.com. Each section gets a pass, warning, or fail badge, shows the exact record found, explains what it does, and includes a ready-to-publish example record you can copy. An overall modern email security score summarizes where you stand.
Deploy MTA-STS in mode: testing first and watch your TLS-RPT reports for a week or two, and only switch to mode: enforce once the reports are clean, or you risk blocking legitimate mail. Remember MTA-STS needs both a DNS TXT record and a live HTTPS policy file at mta-sts.yourdomain.com; a record without a reachable policy does nothing. Bump the id= value in the TXT record every time you change the policy file so senders re-fetch it. BIMI is optional and requires DMARC at p=quarantine or p=reject, and most major inbox providers will not show your logo without a Verified Mark Certificate (the a= tag).
Need reliable hosting? These free tools are brought to you by Ultra Web Hosting. Fast, secure shared and reseller hosting with 24/7 expert support. View hosting plans →