Everything DNS says about your domain’s security, in one table
The mail checker tells you whether your mail will be trusted. This goes further — certificates, DNSSEC, transport encryption for mail — and tells you which of it is optional and which is not.
- Runs from your browser, not our server
- No sign-up
- No watermark
Loading the tool…
How it works
- Type a domain and press Check.
- Read the table: OK, Check or Info, each with a one-line reason.
- Download the Markdown report for the person who manages DNS.
Why nothing is uploaded
Every operation on this page is done by code running inside your browser tab, using the same engine that renders web pages. The file is read from disk into your tab’s memory, transformed there, and written back out as a download. It is never sent anywhere — not to us, not to a third party.
Verify it yourself
- Open your browser’s developer tools (F12) and select the Network tab.
- Load your file and run the tool.
- The only requests you will see fetch the tool’s own code — and, for a few heavy tools, their open-source engine from a public CDN — plus one small page-view ping to loreatec.jp (page address and title, nothing more). None of them carry your file.
Frequently asked questions
What can a browser check, and what can it not?
Everything that lives in DNS: SPF, DMARC, DKIM keys, the MTA-STS and BIMI records, CAA, DNSSEC validation flags and TLSA records. What it cannot do is fetch the MTA-STS policy file from your web server or open a TLS connection to your mail servers — those need a server-side checker, so the tool says “not checkable here” rather than guessing.
How does it find DKIM without knowing the selector?
It tries the twenty selectors that mail providers commonly use (google, selector1/2, k1, s1, default, pm…). A hit proves DKIM exists; a miss proves nothing — your provider may use another name. There is no way to list selectors from outside.
Why compare Cloudflare and Google?
Because a change you just made is visible on one resolver before the other, and because a disagreement that persists points at geo-DNS or a broken secondary. Two independent views cost nothing from a browser.
Are CAA, DNSSEC and DANE required?
No. CAA is a cheap, sensible restriction (only your CAs may issue). DNSSEC and DANE are optional infrastructure that most Japanese domains do not run; the tool marks them Info, not Check, for that reason.