CloudPortal · Email security
Check how your company email domain is configured
Look up SPF, DKIM, DMARC and MX for a domain and see right away what is missing. When the zone is managed in CloudPortal, you can also publish MTA-STS and BIMI from there.
- Look up MX, SPF, DKIM, DMARC, MTA-STS and BIMI for a domain
- See right away what is missing or only monitoring
- Publish MTA-STS and BIMI when the zone is managed in CloudPortal
Email settings are easy to forget and hard to read
SPF, DKIM and DMARC decide whether recipients trust your company's email. The records live in DNS, use different formats and rarely change, which makes it easy to miss that a policy only monitors, or that a domain has no protection at all.
CloudPortal separates two things: reading how a domain is configured, and publishing the policies the portal can host for you.
What it looks like
Example: checking example.com
Ahead of a procurement, the IT manager wants to know how the company's email domain holds up.
- 1
Look up the domain
The lookup reads what is published in public DNS: MX, SPF, DKIM selectors, DMARC, MTA-STS, TLS-RPT, CAA and BIMI. It changes nothing.
- 2
See what needs doing
SPF and DKIM are in place, but DMARC is set to p=none and only monitors. MTA-STS is missing entirely.
- 3
Publish MTA-STS
If the zone is in the portal, you can publish MTA-STS from there. The portal hosts the policy and writes the DNS records. The policy starts in testing mode before it is enforced.
Read or publish
Lookup
Check any domain. The result is based on public DNS and changes nothing.
MTA-STS
The portal hosts the policy and writes the records, including TLS-RPT. Before the policy is enforced, your MX servers are checked.
BIMI
The portal checks the logo and the certificate, hosts the files and writes the BIMI record.
SPF, DKIM and DMARC
The records are checked in the lookup and managed as ordinary records in the DNS modules.
What you need
Lookups work for any domain. Publishing needs a little more.
- Proven ownership
- Ownership is proven automatically when the zone is on CloudPortal's name servers and delegated. Otherwise it is proven with a TXT record.
- Zone access and permission
- For the portal to write the DNS records, the zone must be in the portal and the person publishing must be allowed to edit records. Otherwise you add the records yourselves.
- For BIMI
- A logo in SVG Tiny PS format, a VMC or CMC certificate and a DMARC policy that is enforced.
Frequently asked questions
How do we check SPF, DKIM and DMARC for our domain?
Use the lookup in CloudPortal. Enter the domain to see MX, SPF, DKIM selectors, DMARC, MTA-STS, TLS-RPT, CAA and BIMI as published in public DNS.
Can CloudPortal create our DMARC record?
You add the DMARC record as an ordinary TXT record in the DNS module, and the lookup shows how it is interpreted. What the portal publishes and hosts for you is MTA-STS and BIMI.
What is MTA-STS and do we need it?
MTA-STS tells sending mail servers to use an encrypted connection to your MX servers. It protects against email being sent unencrypted or ending up on the wrong server. The portal hosts the policy and starts in testing mode, so you can review the reports before the policy is enforced.
Does BIMI guarantee that our logo is shown?
No. The portal checks that the requirements are met and publishes BIMI, but whether the logo is shown is decided by the recipient's email service.
Does the lookup change anything in our DNS?
No. The lookup only reads what is already published.
See how your email domain holds up
We'll run a lookup together and show what it takes to publish MTA-STS and BIMI.