Spoof Check

What this can't see

• Everything here comes from public DNS over HTTPS. It reads what a receiving mail server would read before accepting mail — it never connects to your mail server.
• The MTA-STS policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt is fetched by mail servers, not browsers, so its mode (enforce vs testing) isn't readable here — only the DNS record and whether the policy host resolves.
• No STARTTLS / certificate handshake, no open-relay test, no blocklist (RBL) lookup, and no inbound filtering assessment.
• DKIM selectors aren't enumerable in DNS. "Not detected" means none of the probed selectors answered — it doesn't prove DKIM is missing.