What this analysis does
Paste a list of domains or email addresses and Mailybox checks each one for mail routing, SPF presence and qualifier, the DMARC policy that actually applies after the RFC 9989 discovery walk, transport-security policy and discoverable DKIM selectors. The result is a graded table that shows at a glance which domains are protected, which only monitor, and which publish nothing at all.
Organizations rarely have one domain. Brand domains, regional domains, acquisitions and defensive registrations each carry their own authentication posture, and the weakest one is the one an attacker will use. Checking them individually does not scale; a single graded table does.
What is checked for each domain
For every domain the checker reads inbound routing, the SPF record and its default qualifier, the DMARC policy that actually applies after the RFC 9989 discovery walk, whether MTA-STS is published, and which common DKIM selectors resolve. Effective DMARC is the important distinction: a subdomain with no direct record can still be governed by an organizational policy, and the checker reports that rather than a false negative.
Each row receives a letter grade so the table can be scanned. A means enforcing DMARC with SPF hard fail; F means neither SPF nor DMARC exists. The grade is a prioritization aid for a portfolio, not a certification of any single domain.
- DMARC uses policy discovery, so inherited policies are recognized.
- Grades rank the portfolio; the columns hold the evidence.
- Email addresses can be pasted; the domain part is extracted.
Parked and non-sending domains still need records
Domains that send no mail are the easiest to spoof, because nobody watches them and nothing is published. The correct posture is explicit: SPF of v=spf1 -all, DMARC at p=reject, and a Null MX so senders fail fast rather than falling back to the web server. The checker flags domains with no MX and no policy so they can be locked down.
Acquired domains deserve particular attention. They frequently carry stale SPF includes for platforms the previous owner used, which remain live authorizations for whoever controls those platform accounts now.
Generate the null-sender SPF recordGenerate a reject policy for parked domains
Turn the table into a plan
Sort by grade and work upward. Domains with no DMARC at all are the first fix because a monitoring policy with reporting costs nothing and immediately starts producing evidence. Domains at p=none are next; their reports show whether enforcement is safe. Domains already enforcing need only periodic re-checks.
Re-run the audit after every change and on a schedule. Vendor onboarding, migrations and DNS provider changes all alter posture quietly, and a quarterly run of the same domain list catches drift before it becomes an incident.
Find stale authorizations on a specific domainDiff a domain before and after a change
Example: a mixed portfolio
Evidence supplied
Twelve domains: the main brand, three regional variants, two acquired brands and six defensive registrations.
How to read the result
The table shows the main brand at A, regional variants at B or C, one acquired brand at D with a stale SPF include, and every defensive registration at F. The findings prioritize publishing reject policies on the six unprotected domains and reviewing the acquired domain’s authorizations.
Known limits
- DKIM selectors are discovered from common names only; a domain may sign with selectors the audit does not observe.
- Public DNS shows configuration, not whether a domain actually sends or how receivers treat its mail.
- A time budget applies; very slow resolvers can cause the last domains in a long list to be skipped.
Common questions
Why does a subdomain show a DMARC policy when it has no record?
DMARC policy is inherited through the RFC 9989 discovery walk. The checker reports the policy domain that actually applies.
What should a parked domain publish?
v=spf1 -all, a DMARC record with p=reject, and a Null MX record. That combination makes the domain unusable for spoofing.
How many domains can be checked at once?
Up to 25 per run. Duplicates are removed and email addresses are reduced to their domain.