Skip to main content
Tidy Names

Email Security

Tidy Names analyses your domains' email authentication records against best practices. Properly configured SPF, DMARC, and DKIM records help prevent email spoofing and phishing.

What Gets Checked

The email security analysis checks three key protocols for each domain:

SPF (Sender Policy Framework)

SPF defines which mail servers are authorised to send email on behalf of your domain. Tidy Names checks:

  • Whether an SPF record exists
  • Whether the policy uses -all (strict, recommended), ~all (soft fail), or +all (dangerous - allows anyone to send)
  • Whether there are multiple conflicting SPF records
  • Whether the record stays within the 10-lookup limit

DMARC (Domain-based Message Authentication)

DMARC builds on SPF and DKIM to tell receiving mail servers what to do with messages that fail authentication. Tidy Names checks:

  • Whether a DMARC record exists at _dmarc.yourdomain.com
  • The policy setting - reject (strongest), quarantine, or none (monitoring only)
  • Whether reporting URIs are configured (rua/ruf)
  • The percentage of messages the policy applies to

DKIM (DomainKeys Identified Mail)

DKIM uses cryptographic signatures to verify that email content hasn't been tampered with in transit. Tidy Names probes 25+ common selectors including:

  • default, google, selector1, selector2, k1, and others
  • Provider-specific selectors for Google Workspace, Microsoft 365, Mailchimp, SendGrid, etc.

Viewing Email Security

There are two places to check email security:

Domain Overview

Each domain's overview page shows a summary card with the status of all three protocols - a quick pass/warn/fail at a glance. Click the card to go to the full analysis.

Email Security Tab

On a domain's detail page, click the Email Security tab to see:

  • Overall status banner
  • Per-protocol breakdown with Pass, Warning, or Fail badges
  • The actual DNS record values (with a copy button)
  • Detailed recommendations for each check

Status Meanings

StatusMeaning
PassThe record exists and follows best practices
WarningThe record exists but could be improved (e.g. DMARC policy set to "none")
FailThe record is missing or critically misconfigured

Recommended Configuration

For maximum email security, aim for:

  • SPF : A single record with -all (hard fail) listing only your authorised senders
  • DMARC : Policy set to reject with reporting URIs configured so you receive aggregate reports
  • DKIM : At least one valid DKIM key configured for your email provider

Next Steps