Email and DNS security checks

Every check Zenithmark runs on a domain, what it inspects, why it matters, and how to verify and fix it.

Email authentication

SPF record missing or invalid: how to check and fix it high Checks that your domain publishes exactly one valid SPF record ending in -all or ~all, so receivers can tell which servers may send as you.
SPF too many DNS lookups (permerror): how to count and fix medium Counts the DNS lookups your SPF record causes. Over 10, receivers return a permanent error and SPF stops working. Shows how to count and cut them.
DMARC p=none: what to do next, and DMARC missing or invalid high Checks for a DMARC record with p=quarantine or p=reject. p=none only reports. Shows how to read, verify and move your policy to enforcement.
DMARC rua reporting not set up or not authorised low Checks that your DMARC record asks for aggregate reports (rua) and that any external report address has authorised your domain.
DKIM selector not found: how to check your DKIM record medium Probes common DKIM selectors for a published key of 2048-bit RSA or Ed25519. Not finding one is a warning, never a failure: selectors cannot be listed.
BIMI record check: show your logo in inboxes info Informational. If DMARC is enforced, checks for a BIMI record with a logo URL. Never changes your score.

MX records not resolving or pointing at a CNAME: how to check high Checks that every MX host resolves to public addresses and is not a CNAME or IP address, so other servers can deliver mail to you.
Does my mail server support STARTTLS and have a valid certificate? high Connects to your MX servers on port 25 to test STARTTLS, TLS 1.2 or newer, and a valid certificate. Skipped if port 25 is unreachable from us.
MTA-STS policy not found or invalid: how to set it up medium Checks for an MTA-STS record and a valid policy file in enforce mode covering every MX. Missing MTA-STS is a warning, not a failure.
TLS-RPT record missing: how to get SMTP TLS reports low Checks for a TLS-RPT record so mail senders report TLS and MTA-STS delivery problems to you. Missing is a low-priority warning.

Name server (NS) check: lame delegation, one NS, mismatched SOA serials medium Queries each of your authoritative name servers to check they answer, agree on the SOA serial, and are on more than one network.
CAA record missing: which CAs can issue certificates for my domain? low Checks for CAA records, found on the domain or any parent, that restrict which certificate authorities may issue for it. None is a low-priority warning.
Is DNSSEC enabled on my domain? How to check and fix it medium Checks whether your zone has a DS record at the parent and whether a validating resolver accepts the signatures. Unsigned is a warning.
Dangling CNAME and subdomain takeover: how to find and remove them high Looks for CNAME records, on common subdomains and names in your MX, SPF and DMARC records, that point at names which no longer exist (takeover risk).

HTTPS certificate and HSTS check: expired, name mismatch, TLS version medium Checks that your domain or www serves a valid, unexpired HTTPS certificate over TLS 1.2 or newer, with an HSTS header.