Email Security Analyzer
Analyze domain email transport security posture across SPF, DMARC, MTA-STS, TLS-RPT, and BIMI DNS security records with actionable remediation guidance.
Interactive Workbench
Real-time processing directly in your browser.
Domain Email Transport Security and Defensive Posture Audit
The Email Security Analyzer performs defensive security audits of domain-level email transport protocols. Operating entirely within your web browser, security teams, CISOs, and network engineers can evaluate domain resistance against eavesdropping, MITM downgrade attacks, and email spoofing without transmitting sensitive network data.
This utility analyzes Sender Policy Framework (SPF), DMARC enforcement, SMTP Strict Transport Security (MTA-STS), SMTP TLS Reporting (TLS-RPT), and Brand Indicators for Message Identification (BIMI) DNS security records.
The workspace calculates a comprehensive 0–100 security score and letter grade (A+ through F), categorized by Authentication, Transport Security, MX Infrastructure, and Brand Protection, complete with severity-rated findings and actionable remediation code snippets.
Core Tool Capabilities
- MTA-STS Transport Security Audit: Inspects _mta-sts DNS records to ensure SMTP Strict Transport Security is active, preventing TLS downgrade attacks.
- TLS-RPT Reporting Inspection: Checks _smtp._tls DNS records to verify SMTP TLS failure reporting configuration for transport security visibility.
- SPF and DMARC Defensive Analysis: Evaluates DMARC enforcement strength (p=reject) and SPF qualifiers (-all) to prevent unauthorized domain spoofing.
- Severity-Rated Remediation Guidance: Produces structured security findings categorized by Critical, High, Medium, Low, and Info severity with exact DNS remediation syntax.
Local Browser Privacy
Your files are processed locally on your device. Files are not uploaded, transmitted, or stored on remote servers.
Once the page has loaded, you can disconnect your network connection and continue using this tool offline.
Target Use Cases
- • Enterprise Email Transport Security Hardening
- • Vendor and Third-Party Risk Audits
- • Compliance and NIS2 / Cyber Essentials Alignment
- • Phishing Resistance and Brand Spoof Defense
Technical Specifications & Platform Limits
Comprehensive transport and authentication protocols.
Defensive SMTP transport encryption posture.
Encrypted DoH lookups with zero tracking.
Private in-browser evaluation.
Step-by-Step Workflow
Enter Domain to Analyze
Type the target domain name (e.g. google.com or yourdomain.com) into the input field.
Execute Email Security Audit
Click Analyze Email Security to fetch and evaluate SPF, DMARC, MTA-STS, TLS-RPT, and BIMI DNS records via DoH.
Review Overall Security Score & Pillars
Examine your domain's letter grade (A+ to F), overall security score, and individual pillar scores.
Follow Remediation Guidance
Review severity-rated security findings and copy recommended DNS TXT record syntax to fix security gaps.
Practical Real-World Use Cases
Enterprise Email Transport Security Hardening
Security engineers enforcing MTA-STS and TLS-RPT to secure incoming mail traffic against eavesdropping.
Vendor and Third-Party Risk Audits
Security analysts evaluating the email transport security posture of third-party vendors and partners.
Compliance and NIS2 / Cyber Essentials Alignment
Compliance officers auditing domain security controls against cybersecurity standards requiring transport encryption.
Phishing Resistance and Brand Spoof Defense
Corporate defensive teams configuring DMARC enforcement and BIMI to safeguard brand reputation from executive impersonation.
Frequently Asked Questions
- What is MTA-STS and why is it important?
- SMTP Strict Transport Security (MTA-STS) enforces TLS encryption for incoming SMTP connections. It prevents Man-in-the-Middle (MITM) downgrade attacks where attackers force mail servers to communicate unencrypted in plain text.
- What is TLS-RPT?
- TLS Reporting (TLS-RPT) enables sending mail servers to send automated reports when TLS encryption negotiations fail due to certificate issues or MTA-STS policy errors.
- How does MTA-STS differ from STARTTLS?
- Standard STARTTLS is opportunistic and vulnerable to downgrade attacks. MTA-STS makes TLS encryption mandatory and validates certificate authenticities before sending mail.
- Why does the tool show separate scores for Authentication and Transport Security?
- Authentication (SPF/DMARC) verifies that the sender is authorized to represent the domain, while Transport Security (MTA-STS/TLS-RPT) encrypts the transmission channel to prevent interception. Both are distinct, necessary pillars.
- Are my security audit results saved or uploaded anywhere?
- No. The analyzer performs encrypted DNS-over-HTTPS queries directly from your client browser and computes security scores locally in temporary memory with zero persistence.
Share this tool
Help others discover this utility. No login or registration required.
Master this tool with Guides & Articles
Learn the workflows, common mistakes, and advanced techniques behind Email Security Analyzer - MTA-STS, TLS-RPT & Transport Security with our deep-dive educational content.