How PostureCheck Works

Sender Policy Framework. We check for a valid SPF TXT record at the root domain. We also inspect the all mechanism: -all (hardfail) scores higher than ~all (softfail). We also warn if the record exceeds 10 DNS lookups, which causes SPF to break per the RFC.

DomainKeys Identified Mail. We check for DKIM public key records using the MX records to identify the email provider and try provider-specific selectors first (e.g. google for Google Workspace, selector1/selector2 for Microsoft 365), followed by a list of common selectors. We also parse the key type and size — 1024-bit RSA keys are flagged as weak; 2048-bit or Ed25519 are considered good. Because DKIM selectors are not publicly discoverable, a selector not found is shown as a warning rather than a hard failure when DMARC enforcement is in place. One exception: a domain publishing v=spf1 -all with no authorised senders, alongside an enforcing DMARC policy, is explicitly declaring that it sends no email. That is a complete and correct configuration for a parked or web-only domain, so DKIM is marked not applicable and scored as a pass rather than a failure.

Domain-based Message Authentication, Reporting and Conformance. We check for a DMARC TXT record at _dmarc.domain and parse the policy: reject scores highest, followed by quarantine, then none. We also surface the reporting address (rua) so you can confirm reports are being collected. For subdomains, we follow the DMARC inheritance model per the RFC. Note that RFC 7489 was obsoleted in May 2026 by RFC 9989 (core protocol), RFC 9990 (aggregate reporting) and RFC 9991 (failure reporting) — DMARC now has formal IETF Standards Track status. The record tags are unchanged; the main difference is that organisational domain discovery now uses a DNS tree walk rather than the Public Suffix List.

Mail Transfer Agent Strict Transport Security. MTA-STS tells sending mail servers that your domain requires TLS-encrypted delivery — and that they should refuse to deliver if TLS is not available or the certificate is invalid. We check for a valid TXT record at _mta-sts.domain and fetch the policy file at https://mta-sts.domain/.well-known/mta-sts.txt. We parse the mode: enforce (email rejected if TLS fails — best) scores highest, testing is monitoring-only and shown as a warning. MTA-STS is not yet widely deployed and does not affect the email security score.

TLS / SSL

Certification Authority Authorization. CAA DNS records specify which Certificate Authorities are permitted to issue SSL/TLS certificates for your domain. Without CAA records, any CA in the world can issue a certificate for your domain — a meaningful risk if a CA is compromised or makes an error. We check for CAA records using DNS CAA lookup and list the permitted issuers. CAA is not yet widely deployed and does not affect the SSL score.

Forces browsers to always use HTTPS for your domain, preventing protocol downgrade attacks. Defined in RFC 6797 and required by NIST SP 800-52.

Controls which resources the browser is allowed to load, blocking cross-site scripting (XSS) and data injection attacks. Defined by the W3C and recommended by OWASP.

Prevents your site from being embedded in iframes on other domains, blocking clickjacking attacks. Defined in RFC 7034. Can also be set via CSP frame-ancestors.

Prevents browsers from guessing (sniffing) the content type of a response, which can be exploited to execute malicious scripts. Recommended by OWASP.

Controls how much referrer information is sent when a user clicks a link from your site. Prevents leaking sensitive URLs to third parties. Defined by the W3C.