How the check works
Every check reads public DNS records, the same ones any mail server reads before deciding what to do with a message. Nothing connects to a mail server and nothing is sent.
How a level is set
Each domain gets one level, taken from its DMARC record alone. DMARC is the record that tells receivers what to do with mail that fails the checks, so it decides what happens to a forgery. Problems with SPF and DKIM show up as findings, and some of them are serious even at the top level.
- ENFORCEDForged mail refused
- PARTIALFiled as spam, or only some refused
- MONITORINGReports only, no action
- UNPROTECTEDNo usable instruction
| Level | Rule |
|---|---|
| ENFORCED | p=reject, and pct absent or 100 |
| PARTIAL | p=quarantine, or p=reject with pct below 100 |
| MONITORING | p=none |
| UNPROTECTED | No DMARC record, more than one, or one that can't be read |
What is checked
- DMARC
- The TXT record at
_dmarc.plus the domain. Its policy, subdomain policy, percentage and report addresses are read following RFC 7489. If reports go to another organization's domain, the scanner checks that the other domain has agreed to receive them. - SPF
- The TXT record at the domain itself, following RFC 7208. Every
include,a,mx,ptr,existsandredirectis counted, including those inside included records. More than 10 lookups, or more than 2 that return nothing, makes SPF fail for every message. - Mail servers
- The MX records. A domain with no mail servers, or a null MX saying it takes no mail, should also say it sends none:
v=spf1 -allandp=reject. - MTA-STS and TLS reports
- These ask other servers to use encryption when delivering mail, and to report when they can't. They protect mail in transit, not against forgery, so they never change the level.
- DKIM
- DKIM keys sit under a selector name that can't be listed, so the scanner tries nine common ones. Finding a key is good news. Not finding one doesn't mean DKIM is missing.
Limits the scanner keeps
- One scan a week, at most four DNS lookups in flight, and a five second timeout.
- The only web request is one fetch of a domain's public MTA-STS policy file, and only when the domain says it has one.
- Requests identify themselves as
SpoofCheckBC/0.1.0with a link to the source code.
What is published
The report page shows totals by sector, never a ranked or named list. Each organization's own results go to its IT team in a private note. The weekly snapshot files in the source repository hold only totals and each domain's level under a keyed hash, so they can be compared week to week without naming anyone.
The checker on the report page is different: it looks up whatever domain you type, the same way any public DNS tool does. Your browser sends the lookups to Google's public DNS service (dns.google). The domain itself isn't contacted, and the browser can't fetch MTA-STS policy files, so the checker reads only their TXT records.
What it can't tell you
- Whether a body's mail filters catch forged mail sent to its own staff. That happens inside their systems.
- Whether DKIM is set up, if they use a selector name we didn't try.
- Whether every legitimate sender passes. Only the organization's DMARC reports show that.
- Anything about websites, passwords or networks. Only public email records are read.