Skip to main content

Domain checker

The Domain checker checks the email security records of your domains: DMARC, SPF, DKIM and DNSSEC. Open it from Threat monitor in the left navigation of the XFA dashboard.

Each record protects your domain against a different kind of abuse:

  • SPF (Sender Policy Framework) lists the servers that may send email for your domain.
  • DKIM (DomainKeys Identified Mail) signs outgoing email, so a receiver can tell it was not changed on the way.
  • DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receivers what to do with email that neither SPF nor DKIM confirms as coming from your domain: nothing, quarantine it, or reject it. One of the two is enough, so forwarded email that fails SPF still passes DMARC when its DKIM signature checks out.
  • DNSSEC (Domain Name System Security Extensions) signs your DNS records, so an attacker cannot point your domain somewhere else.

The Domain checker is in beta and is switched on per organization. If you do not see Threat monitor in the navigation, it is not switched on for your organization yet.

Add a domain

Type a domain, for example example.com, and click Add domain. XFA checks it within a minute and again every day. The row shows Pending until the first results are in. Click the refresh icon above the list to load the latest results.

Add every domain you send email from, including domains that only send, such as a marketing domain. Remove a domain with the trash icon next to it.

Administrators with the Read only role see the results but cannot add or remove domains. See Team & roles.

Read the results

Each domain gets a score out of 100, and so does each of the four records. 80 or higher is good, 60 to 79 needs attention, and below 60 is a risk. Click a domain to open its details:

  • Record: the value XFA found in DNS, or Not found.
  • Warnings: what is wrong, for example a DMARC policy of none, which lets spoofed email through.
  • Recommendations: what to change, starting with what helps most.

The records live at your DNS provider, not in XFA. XFA sees a change at the next daily check, not when you click the refresh icon, which only loads the results XFA already has. After that check, click the refresh icon, open the domain and look at Last checked to make sure the results are newer than your change.