Email spoofing check

Could someone send a convincing invoice from your client’s domain? Steeplejack reads the domain’s public DNS records to see how well it’s protected.

What each record does

SPF: Lists the servers allowed to send email for the domain.
DKIM: Signs outgoing email, so a receiver can tell it hasn’t been altered. Selectors can have any name, so the survey tries common ones: not finding one doesn’t prove it’s missing.
DMARC: Tells receivers what to do with email that fails those tests. Without an enforced policy, spoofed email can still get through.
MTA-STS: Asks other mail servers to use encrypted connections when delivering to the domain.

This is easy to overlook, because nothing on the website looks wrong when it’s missing.

Email spoofing protection (SPF, DKIM, DMARC, MTA-STS), CAA and DNSSEC
Without an enforced DMARC policy, nothing tells receiving mail servers to reject email pretending to come from your domain, though their own filters may still catch it. If the domain is used for business, this is how fake invoices and password resets get sent. SPF and DKIM prove which mail is genuine; DMARC tells inboxes what to do with the rest. MTA-STS stops mail sent to you being downgraded to unencrypted. CAA limits who can issue certificates for your domain.