Email Auth Checker (Free)

Check a domain's email authentication in one command: SPF, DKIM, DMARC, MX, MTA-STS and TLS-RPT, with plain-English problems and fixes. Built on the current standards, including DMARCbis (RFC 9989, May 2026).

python3 -m emailauth example.com
python3 -m emailauth example.com -s google -s s1        # DKIM selectors from s= in a DKIM-Signature header
python3 -m emailauth example.com example.org --json     # several domains, JSON for scripts; exit code 1 on high-severity problems

• SPF (RFC 7208): one record only, syntax, +all / ?all, missing all, ptr, includes without an SPF record (permerror), include loops, the 10 DNS lookup limit counted through every include, void lookups, record length.
• DMARC (RFC 9989, RFC 9990): one record, valid p / sp / np / adkim / aspf / t, p=none still delivers spoofed mail, missing rua reports, external report addresses that haven't authorised your domain (yourdomain._report._dmarc.vendor), and tags DMARCbis removed (pct, ri, rf).
• DKIM: the selectors you give (or 20 common ones), v=DKIM1, revoked keys (empty p=), RSA key size (under 1024 bits fails; 2048 recommended), ed25519 keys, test mode.
• MX, MTA-STS (RFC 8461), TLS-RPT (RFC 8460): null MX, the _mta-sts record id, the policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt (version, mode, max_age, mx lines) and MX hosts the policy doesn't cover, and the _smtp._tls reporting record.

DNS goes over HTTPS (Cloudflare by default, --doh google), so it works anywhere Python does. ./demo.sh runs offline against examples/zone.json (one broken domain, one clean one); ./run_tests.sh runs the tests. Python 3.9+, no dependencies.

It reads public DNS; it can't see which servers really send your mail or whether messages pass. DKIM selectors can't be listed from DNS, so unknown selectors are only found when you pass them. SPF macros (%{...}) aren't expanded.