Spoof Check

What this can't see

• Everything here comes from public DNS over HTTPS. It reads what a receiving mail server would read before accepting mail — it never connects to your mail server.
• The MTA-STS policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt is fetched by mail servers, not browsers, so its mode (enforce vs testing) isn't readable here — only the DNS record and whether the policy host resolves.
• No STARTTLS / certificate handshake, no open-relay test, no blocklist (RBL) lookup, and no inbound filtering assessment.
• DKIM selectors aren't enumerable in DNS. "Not detected" means none of the probed selectors answered — it doesn't prove DKIM is missing.

What this records

• Which domains are checked and how they scored, so we can see what the tool is used for. That's it — no IP addresses, no cookies, no device or browser fingerprinting, and nothing that identifies you.
• If you email yourself a report, the address is used to send that one message and isn't added to any list.