Skip to content
App

All articles

Email server audit

The email audit checks the public mail setup of a domain (DNS and SMTP) from the outside. It does not log in to the mailbox. Create it under Facilities → Audit.

The audit is free. Paid extras use Cart and Checkout.

Before you start

  1. Create a domain facility (FQDN) and a server facility.
  2. Create an email server facility that links both, and set DKIM selector (for example google or s1). Without a selector, DKIM is skipped and scores 0 as a warning.
  3. New audit, pick that email server.

Running checks

On the audit page: Run all checks, or run DNS as one card and SMTP STARTTLS on its own card. The audits list can run all checks the same way.

Statuses:

  • PASS — the check succeeded
  • FAIL — a problem in DNS or SMTP (red)
  • ERROR — the check could not finish (timeout, refused query); retry (yellow)

Score

The total is shown after all eleven checks have a result (DKIM without a selector still counts as 0 / warning). Weights add to 100:

CheckWeight
MX15
SPF12
DKIM12
DMARC12
MX hosts10
PTR10
SMTP10
DNS block lists10
MTA-STS4
BIMI3
TLS-RPT2

100 is green. Below 100 is yellow if there are only warnings, red if any check FAILed. A dash means not all checks have run.

MX records (mx)

Looks up MX for the domain, ordered by preference. Missing MX FAILs. Priority 0 with exchange . is a null MX (the domain accepts no mail) and FAILs.

Fix: publish MX pointing at hosts that receive mail, or a null MX if the domain must not accept mail (that still fails this audit).

MX hosts (mx-hosts)

Each MX name must have A or AAAA and must not be a CNAME. AAAA may be absent. Null MX FAILs.

Fix: point MX at a hostname with its own A/AAAA, not a CNAME.

PTR (ptr)

Each MX address must have a PTR that resolves back to the same address (forward-confirmed reverse DNS). A PTR that differs from the MX hostname is recorded and still PASSes.

Fix: ask the IP owner to set PTR, then A/AAAA for that name back to the IP.

SMTP STARTTLS (smtp)

TCP 25 to each MX: banner 220, EHLO, STARTTLS offered, certificate matches the MX name, currently valid, TLS 1.2 or 1.3. Refused or timed-out connection is ERROR.

Fix: listen on 25, offer STARTTLS, use a certificate for the MX hostname.

DNS block lists (dnsbl)

IPv4/IPv6 of each MX: zen.spamhaus.org, bl.spamcop.net, psbl.surriel.com. Domain and MX names: dbl.spamhaus.org. Only a confirmed listing is FAIL. Connection and query errors are ERROR.

Fix: check the listing, stop the abuse, then use that list's removal page.

SPF (spf)

Exactly one TXT v=spf1. all last, -all or ~all. At most 10 DNS lookups (include, a, mx, exists, redirect). +all, ?all, missing all, ptr, two records, or a redirect loop FAIL.

Fix: one SPF record, -all or ~all, flatten includes under 10 lookups.

DKIM (dkim)

TXT at {selector}._domainkey.{domain} (CNAME followed). One record, non-empty p=, no t=y. RSA ≥ 2048 bits; k=ed25519 PASSes. Empty p=, testing mode, short RSA, or missing record FAIL.

Fix: set the selector on the email server, publish a production key.

DMARC (dmarc)

One TXT v=DMARC1 at _dmarc.{domain}, p=quarantine or p=reject, pct omitted or 100. p=none or pct below 100 FAIL. External rua=mailto: needs {domain}._report._dmarc.{rua-domain}.

Fix: enforce quarantine or reject at 100%, authorize external rua hosts.

MTA-STS (mta-sts)

TXT v=STSv1; id=... at _mta-sts.{domain}, then HTTPS https://mta-sts.{domain}/.well-known/mta-sts.txt with no redirects. Mode enforce, max_age > 0, every live MX matches an mx pattern (* is one leftmost label). testing / none FAIL.

Fix: publish the TXT and an HTTPS policy in enforce that lists your MX hosts.

TLS-RPT (tls-rpt)

One TXT v=TLSRPTv1 at _smtp._tls.{domain} with rua mailto: or https:.

Fix: add the TLS reporting TXT with a mailbox or HTTPS endpoint you read.

BIMI (bimi)

One TXT v=BIMI1 at default._bimi.{domain} with HTTPS l=. DMARC must be quarantine or reject. Logo URL returns 200, image/svg+xml, no redirect. a= (VMC) is stored and not required to pass.

Fix: SVG Tiny PS logo on HTTPS, DMARC at enforcement, then the BIMI TXT.

Mailbox provider requirements

These are not extra Emperor checks; they explain why SPF, DKIM, DMARC, and PTR matter:

Articles