DNS policies help describe authorized senders and treatment of messages. Website scanning does not prove that every message is authenticated or encrypted.
The following checks provide related public observations. Their presence does not mean this entire topic has been tested or that the application is secure.
Reads the domain's SPF record and checks that it ends with ~all or -all.
Publish one SPF record that lists your mail providers and ends with ~all (or -all once DMARC reports look clean), e.g. v=spf1 include:_spf.google.com ~all.
Reads _dmarc and checks that the policy is quarantine or reject.
Publish _dmarc TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain" and move to p=reject after reviewing reports.
For domains that receive email, checks for an MTA-STS policy record.
Publish _mta-sts TXT "v=STSv1; id=<date>" and a policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt.
A blocked or unfinished check remains unverified. Review technical recommendations with the person operating the website and test changes before applying them to a live service.
Read the full methodology