What this is. A rule-based questionnaire about email security configuration that you can see for yourself in your admin consoles and DNS. It turns your answers into a prioritised list of what to look at, with plain-language fixes and links to the guide that explains each one.
What it is not. It does not scan, query or look up your domain, mailboxes or tenant. It cannot tell you that anything is protected, verified or correct. It never asks for a password, an MFA code, a token or any message content, and nothing you enter leaves your browser, is stored, or sets a cookie. DNS records and tenant settings must be verified with your own DNS tools and admin consoles.
How the result is worked out
Each question has a weight from 1 to 5 for how much a gap matters, and each answer has a risk from 0 (reported as in place) to 1 (reported as absent). “I don’t know” counts as 0.85, close to absent, because a control you cannot confirm cannot be relied on. The readiness figure is 100 minus the weighted share of risk, rounded. It is a way of ordering your attention, not a percentage of security.
Each gap is multiplied out to a severity. A severity of 3 or more goes under “Do first”, 1.5 or more under “Do next”, and the rest under “Later”. Inside each group, items follow a fixed safe order: access and administrator controls, then mailbox abuse, then domain authentication in dependency order (sender inventory, SPF, DKIM, DMARC), then people and process. If administrator MFA or payment verification is absent or unknown, the overall band cannot rise above “Significant gaps” however well everything else scores.
Explain a DNS record you already have
Paste the text of one SPF, DMARC or DKIM TXT record that you obtained with your own DNS tools. The explainer reads the text you pasted and points out syntax problems. It runs entirely in your browser and never fetches DNS: it cannot see your domain, it cannot tell whether the record is the one actually published, and a clean reading does not mean the record is right for your senders. Paste only public record text, never anything secret.
How to read your real records
These commands query public DNS from your own machine. They only read. Replace example.com with your domain, and selector1 with the DKIM selector your mail platform uses.
nslookup -type=TXT example.com
nslookup -type=TXT _dmarc.example.com
nslookup -type=TXT selector1._domainkey.example.com
dig +short TXT example.com
dig +short TXT _dmarc.example.com
Resolve-DnsName -Name _dmarc.example.com -Type TXTA DKIM selector may be published as a CNAME rather than a TXT record, in which case ask for -type=CNAME or follow the alias. Public DNS can differ from what your DNS provider’s console shows while changes propagate, so compare both. For the reasoning behind each record, read SPF, DKIM and DMARC; for the wider order of work, see Microsoft 365 security.