Email authentication
MX, MTA-STS, TLS-RPT and BIMI
Where your mail is delivered, the records that force encrypted delivery and report on failures, and the optional brand-logo record.
Updated · 2 min read
Beyond SPF, DKIM and DMARC, the email section reads four more records. None of them stop forgery; they protect delivery and, in BIMI's case, decorate it.
MX
The MX records say where mail sent to the domain is delivered. The scan lists them, resolves each host, and identifies the provider (Microsoft 365, Google Workspace, Proton, a self-hosted server, and others). That provider identification drives which DKIM selectors are tried and which fix steps are shown. A domain with no MX is "mail not configured", not a failure.
MTA-STS
MTA-STS tells sending servers to deliver to your MX hosts only over authenticated TLS. Two parts are read:
- The
_mta-sts.<domain>TXT record. - The policy file at
https://mta-sts.<domain>/.well-known/mta-sts.txt.
| Finding | Severity |
|---|---|
Record and policy present, mode: enforce |
Pass |
Policy in testing or none mode |
Low: published but not enforced, so downgrade attacks are not yet blocked |
| Record present but the policy file cannot be fetched | Low: sending servers cannot apply it |
An MX host missing from the policy's mx: lines |
Medium |
| Neither record nor policy | Not set (an optional improvement, not a failure) |
TLS-RPT
The _smtp._tls.<domain> TXT record names an address that receives reports about TLS delivery failures. Presence is recorded; absence is a low-priority note. TLS-RPT reports are not ingested by DomainGuard; the record is checked so you know whether anyone would be told when encrypted delivery fails.
BIMI
BIMI publishes a logo that some receivers show beside authenticated mail. It requires DMARC at p=quarantine or p=reject. The record at default._bimi.<domain> is read and its logo URL noted. BIMI is optional and never produces a failure.
Where
Web and iOS: the Email & DMARC module, below the three authentication cards. In the security checkup, MTA-STS and TLS-RPT appear under Email Authentication. The API field is on GET /api/domains/:id/email-security.
Common questions
Should I set up MTA-STS? If your provider supports it (Microsoft 365 and Google Workspace both do), yes. Start in testing mode with a TLS-RPT address so you see failures before enforcing.
Why does the MX check say Review when mail works? Usually one MX host does not resolve or the set includes a legacy host. The page names it.
Keep reading
Related articles
- DMARC setup checklist and deliverability diagnosticsThe five-step setup status, the ranked diagnostic that answers why mail is going to spam, and the two-week / 95% rule before tightening policy.Email authentication ·Updated
- Certificate monitoringWhere certificate data comes from, what the Certificate module shows, subdomain certificates, and the quiet rule for certificates that renew themselves.Domains ·Updated
- Risk bands and signalsHow a lookalike is scored: the four bands, the signals that raise or lower the score (mail, certificate, age, copied title and favicon), and what is not scored.Impostor domains ·Updated