Email security monitoring
Find out the day your email setup breaks,not the day your mail bounces.
Domain Lab checks SPF, DKIM, DMARC, MTA-STS, TLS reporting, BIMI and DNSSEC on every domain you track, grades each one A to F, and alerts you when a record changes, a check breaks, or your protection gets weaker.
Email records break quietly
Someone adds a newsletter service and the SPF record goes over its limit of 10 DNS lookups. A website redesign drops the MTA-STS policy file. A mail provider migration leaves the old DKIM key behind and the new one never gets published. Someone sets DMARC back to p=none "for now" and forgets.
None of these send you an error. Mail starts landing in spam, or anyone can send email that looks like it came from you, and you find out from a customer. Domain Lab checks every day so you find out first.
What Domain Lab watches
A grade for every domain
Each domain gets an A to F grade with the reason in one sentence and the fixes in order, each with the exact DNS value to paste. Your email page sorts every domain worst first.
SPF, DKIM and DMARC
SPF lookups counted against the limit of 10, DKIM keys and their strength, DMARC policy for the domain and its subdomains, and whether your DMARC reports actually get delivered.
MTA-STS and TLS reporting
We fetch your MTA-STS policy file over HTTPS, check its mode, and make sure it lists every mail server you use, so a provider change does not bounce your mail.
BIMI and its certificate
Your BIMI record, the SVG format of your logo, and the expiry date of the mark certificate behind it, with reminders 30, 14, 7 and 1 days ahead.
Domains that send no mail
Parked and unused domains are graded on whether they are locked down, so nobody can send email as them. We tell you the three records that do it.
A history of every change
Every distinct state is kept with a before and after for each record, so "what changed, and when" has an answer. Your AI assistant can read it through the Domain Lab MCP server.
Alerts that only fire when something changes
Email security broken
A check that was working now fails: SPF over its lookup limit, a DMARC record removed, an MTA-STS policy that will not load.
DMARC policy weakened
The policy moved from reject or quarantine toward none, covers less mail, or reports stopped being sent.
DKIM key missing
A signing key that used to be published is gone or revoked, so mail signed with it fails.
BIMI certificate expiring or expired
Your logo certificate is close to its end date, or past it.
Email records changed
Any email record changed, with the old and new values side by side.
Email grade changed
The grade went up or down, including when a fix you made lands.
A domain that has always been weak shows up in its grade and on your Email page, not as a daily alert. A change is checked twice before anyone is alerted, so a slow DNS answer never wakes you up. Alerts go to email, Slack, Pushover, webhooks or your AI assistant, with the same per-domain controls as every other Domain Lab alert.
Included in every plan
Email security monitoring is part of Domain Lab, not an add-on. The free plan watches one domain, and Pro watches up to 100, each next to its registration, DNS and SSL history. See pricing or check a domain now for free.
Frequently asked questions
How often does Domain Lab check email security?
Every day on the free and Pro plans. When something changes, it checks again about 15 minutes later to confirm before alerting you.
Do I need to change my DNS or mail setup to use this?
No. Domain Lab reads your public DNS records and policy files, the same way receiving mail servers do. Nothing about your email changes.
Why is a domain that sends no email graded at all?
Anyone can send email that claims to be from a domain with no SPF or DMARC records, and unused domains are a common choice for phishing. Three records lock it down: SPF set to v=spf1 -all, DMARC set to p=reject, and a null MX record.
DKIM shows as not found, but I have it set up. Why?
DKIM keys live under a selector name chosen by your mail provider, and there is no way to list them. Domain Lab tries the common names and remembers every one it finds. If yours uses a custom name, add it on the domain's Email section and every check will include it.
Watch your email setup with the rest of your domain
Free for your first domain.
Start monitoring free