5 Free Tools to Audit Your Domain Security (Email, DNS, and SSL)

Your domain’s security — making sure your emails land in inboxes, no one can impersonate you, and your website inspires trust — can be fully audited in about 10 minutes using free tools, with nothing to install and no account to create. There are five on ortamarco.me (the domain health report, the email auth checker, the DKIM checker, WHOIS and the security headers checker), and in this guide I’ll walk you through how to use them in order.

If you want a deep dive into the reasoning behind each protocol, check out my guide on how to audit your domain’s email and security step by step. Here we’re getting practical: which tool to open, what each result means, and what to do with it. SPF, DMARC and DNSSEC no longer have a tool of their own: the domain health report checks them, and below I explain what it detects for each.

All of them work in the browser, require no API key or sign-up, and don’t store what you query.

October 2026 update. The standalone SPF, DMARC, DNSSEC, CAA, MTA-STS, TLS-RPT and BIMI checkers were merged into a single query: the Domain Health Report audits DNS, email, TLS and headers at once and returns an ordered list of what to fix first. If you are here to audit a whole domain, or to vet one before buying it, start there and use this guide to understand each result.

Start Here: the Email Auth Checker

If you’re only going to use one tool, make it this one. The Email Auth Checker (SPF, DKIM, DMARC) reviews all three authentication protocols at once and gives you a letter grade from A to F along with a prioritized list of recommendations.

It’s the fastest way to find out whether your domain is at risk. The score is calculated out of 100, with deductions for the things that genuinely break deliverability:

💡 Real example. When I launched these tools, I tested them against my own domain… and ortamarco.me scored an F (55/100): I had SPF, but no DMARC record. I published a DMARC record at p=none and it jumped to C (70/100) within minutes. An audit isn’t just theory — almost every domain is missing something.

Once you have your overall grade, use the individual tools to dig into whatever the checker flagged in red.

SPF: Who Can Send on Your Behalf?

The Domain Health Report analyzes your domain’s v=spf1 record and flags the most common problems that aren’t obvious to the eye. It tells you what is wrong and how to fix it; it does not print the raw record (for that, use the DNS Lookup). Here is what to check:

• The final qualifier. -all (hardfail) is ideal; ~all (softfail) is acceptable; ?all offers no protection; and +all is a security hole.
• The 10-DNS-lookup limit. This is what almost nobody checks: if you chain too many include: directives, SPF exceeds the RFC 7208 limit and stops validating entirely (permerror). The report follows each include to count lookups and warns you when you go over, but it does not show you the exact number while you are under the limit.

It also flags the two serious cases: no SPF at all, and two v=spf1 records, since only one is allowed.

DMARC: the Policy That Decides What Happens

The domain health report reads the _dmarc.yourdomain.com record and flags three things: whether it is missing, whether you are only monitoring (p=none), and whether rua= is absent, meaning you receive no reports. It does not evaluate the percentage (pct=) or show you the full record; for that, read the TXT with the DNS Lookup.

The most common mistake is staying on p=none indefinitely. That policy reports but doesn’t protect — anyone can still impersonate you. The goal is to work your way up to p=reject in stages:

p=none  →  p=quarantine  →  p=reject
(monitor)    (to spam)       (block)

Start at none, read the reports for a week or two, authenticate all your sending providers, and only then tighten the policy. Jumping straight to reject will block your own email.

Check DKIM: the Cryptographic Signature

DKIM is the trickiest of the three, because its key lives under a selector defined by your provider — and there’s no way to guess it. Email auditor handles this in two ways:

• If you know your selector (your provider gives it to you: google, zmail, k1…), you enter it and get a definitive result.
• If you don’t know it, the tool tries a list of common selectors used by the most popular providers.

One caveat: if the automatic lookup finds nothing, it doesn’t mean you don’t have DKIM — you may simply be using a custom selector. When in doubt, ask your email provider for the selector and test it manually.

Beyond Email: Domain, DNS, and Web

Security doesn’t end with email. These three checks cover the rest of the attack surface.

WHOIS Lookup: Don’t Let Your Domain Expire

WHOIS Lookup shows you who registered the domain, when it expires, the registrar, and the DNS servers. The most valuable use is defensive: note the expiration date in your calendar. Every year, businesses lose their domain — and with it their website and email — simply because they forgot to renew it.

DNSSEC and CAA: Tamper-Proof DNS

The domain health report verifies whether your domain cryptographically signs its DNS responses. Without DNSSEC, an attacker could spoof where your domain points (cache poisoning) and redirect your email or website. The report tells apart “not enabled” from “signed but the chain of trust does not validate”, which is the dangerous case. It also warns when the CAA record is missing, which declares which authorities may issue certificates for your domain. Here too it shows only the verdict, not the raw DS/DNSKEY or CAA records. If your registrar supports it, enabling DNSSEC is one of the best security improvements you can make for the effort involved.

HTTP Security Headers: Browser-Level Protection

The domain health report analyzes your website’s HTTP headers (HSTS, Content-Security-Policy, X-Frame-Options, and more) and gives you an A–F grade showing which ones are missing. They’re the first line of defense against clickjacking, content injection, and HTTP downgrade attacks. Most sites fail here without even knowing it.

The Recommended Order: Your 10-Minute Audit

Here’s the sequence I follow. Work through it top to bottom (five tools; the report covers several of the points):

1. Email Auth Checker → your overall grade and the list of what to fix.
2. Domain Health Report → a single SPF record without +all, DMARC with rua= and a plan to tighten the policy, DNSSEC and CAA, certificate and headers; no critical findings.
3. Email auditor → your selector’s key resolves correctly.
4. WHOIS Lookup → note the expiration date.
5. Domain health report → improve your web score.

If everything comes back green, your domain is locked down. If something fails, you’ll know exactly what to ask your provider or developer to fix. Need a refresher on what each DNS record actually is before you start? I have a guide on DNS record types and how propagation works.

Why It Matters in 2026

Since 2024, Google and Yahoo have been rejecting or sending to spam email from domains that don’t authenticate, and by 2026 the requirement is absolute for anyone sending email at scale. A quote that lands in spam is a lost sale; a spoofed domain is a reputation crisis. The good news is that auditing — and fixing — your domain is within anyone’s reach with the right tools and ten minutes.

If you run the audit and something doesn’t add up, or you’d rather have someone get your domain, email, and website fully secured in one go, I can help: take a look at my web development service or, if you’re looking to get your infrastructure in order, custom systems.

Frequently asked questions

Do I need to install anything or create an account to use these tools?

No. All of them run directly in the browser, are free, require no account or API key, and don't store the domains you query. Just type your domain and get results instantly.

What's the point of the Email Auth Checker if there is already a domain health report and a DKIM checker?

The Email Auth Checker reviews SPF, DKIM, and DMARC all at once and gives you an overall letter grade with prioritized recommendations — it's ideal for a quick diagnosis. The domain health report extends the analysis to DNSSEC, CAA, MTA-STS, TLS-RPT, BIMI, the certificate and headers, and the DKIM checker is for when you know your selector.

What grade is considered good in the Email Auth Checker?

An A or B means your domain is authenticated and protected. A C or D means it's working but missing pieces — the most common case is DMARC set to p=none or no detectable DKIM. An F means there's no real protection and your domain is exposed to spam and impersonation.

The DKIM tool found nothing — does that mean I don't have DKIM?

Not necessarily. DKIM uses a selector defined by your provider, and there's no way to guess it. The automatic check tries common selectors, but if you're using a custom one it won't show up. Ask your email provider what your selector is and enter it in the tool for a definitive check.

What is DNSSEC and do I need to enable it?

DNSSEC cryptographically signs your domain's DNS responses so no one can forge where your domain points (cache poisoning). It's not mandatory, but it's one of the best security improvements you can make for the effort involved: if your registrar supports it, enabling it protects your email and website against malicious redirects.

How long does it take to audit my domain? About 10 minutes following the order above: start with the Email Auth Checker for the overall grade, then use the domain health report and the DKIM checker for the details.

Do I need to sign up? No: all tools are free, require no account or API key, and don’t store what you query.

Did you audit your domain? Tell me what grade you got in the Email Auth Checker.