24 – Email (Beta)

Email is the most common way into an organisation for fraud. The test checks whether the domain is configured so that others can send mail in your name, and whether mail to you is protected in transit.

What is tested?

SPF

States which servers may send email for the domain. The test checks that a record exists, that it's correctly formed, and that it doesn't require more DNS lookups than the standard allows.

DKIM

Signing of outgoing mail, so the recipient can verify it wasn't altered in transit.

DMARC

Rules for what the recipient should do with mail that fails SPF or DKIM. The test audits the record in detail. It checks the policy and subpolicy, and the percentage the policy applies to. It also checks the alignment settings for SPF and DKIM, the report format and the reporting interval. Common faults it catches are a policy set to none, a pct below 100, and failure reports being requested without an address to send them to.

MTA-STS

Requires email to the domain to be delivered encrypted. The test checks both the DNS record and the policy file, including that it uses the right line breaks and a valid mode.

Transport

Connections to the domain's mail servers over IPv4 and IPv6.

How it affects the score

Missing records lower the score most. Malformed records are judged more harshly than absent ones, because they tend to give false confidence.

Running the test

python default.py -u https://example.com -t 24 -r

Settings

Both are off by default because the environments the test usually runs in lack the support: consumer broadband blocks port 25 and GitHub Actions has no IPv6. Running locally with both available gives you more checks:

python default.py -u https://example.com -t 24 -r \
  --setting tests.email.support.port25=true \
  --setting tests.email.support.ipv6=true

See also

• 32 – DNS (Zonemaster)