DMARC Analyzer 2.0 - DNS Checker

This article contains information on using the DNS Checker in Mimecast DMARC Analyzer to validate and troubleshoot DNS records, including DMARC, SPF, DKIM, and BIMI, ensuring proper email authentication and compliance with best practices.

Overview

The DNS Checker in Mimecast DMARC Analyzer helps you quickly check and troubleshoot the DNS records that control your email authentication. It focuses on four key record types:

• DMARC
• SPF
• DKIM
• BIMI

From one place, you can see whether these records exist, if they are valid, and what they contain. This makes it easier to keep your domain secure and your email deliverability high.

Domain Checker

To access the DNS Checker, follow these simplified steps:

1. Log in to Mimecast Administration Console
2. From the menu panel, navigate to More Services | DMARC Analyzer 2.0 | DNS Checker

The Domain Checker tab is designed for a quick, high‑level health check of your domain’s email authentication.

3. Enter your domain name and click Check Domain.
4. DNS Checker retrieves and displays the current:

• DMARC record
• SPF record
• DKIM records (with optional selector search)
• BIMI record

How it helps

• Quickly confirms if critical records are present and valid.
• Highlights missing or incorrectly configured records.
• Gives you a single view of your domain’s email authentication posture.

DMARC

The DMARC Checker tab focuses specifically on your DMARC record.

1. You enter your domain and select Validate DMARC.
2. DNS Checker retrieves your DMARC record and shows:

• The full record value
• All declared tags (for example, policy, alignment, reporting)
• Explanations of what each tag means and how it behaves

3. It confirms whether the record is valid and usable.

Why this is useful

• Helps you understand what your DMARC policy is actually doing (e.g., monitoring only or actively rejecting).
• Makes it easier to align your DMARC configuration with your security and deliverability strategy.
• Reduces guesswork when you change or tighten your DMARC policy.

DKIM

The DKIM Checker tab is dedicated to validating DKIM records.

1. Enter your:

• Selector
• Domain key (if required)
• Domain name

2. Click Check DKIM to retrieve the DKIM record. 
3. Validate that it is correctly formatted and available in DNS

Why this is useful

• Confirms that DKIM keys are correctly published for your domain.
• Helps you troubleshoot issues when email is not being DKIM‑signed as expected.
• Supports alignment with your wider email authentication strategy (alongside SPF and DMARC)

SPF Checker

The SPF Checker tab helps you validate and optimize your SPF record.

1. Enter your domain and select Validate SPF.
2. Optionally, you can paste a proposed SPF record to Pre‑validate a change before you update DNS.
3. You can specify a date range to analyze the email volume associated with that SPF configuration.
4. DNS Checker then:

• Confirms whether the SPF record is syntactically valid
• Shows DNS lookups and included mechanisms
• Lets you expand or collapse sections for more detail

Why this is useful

• Reduces the risk of breaking SPF when adding new senders or services.
• Helps ensure your SPF record stays within DNS lookup limits.
• Gives insight into how changes may impact real email traffic.

BIMI Checker

The BIMI Checker tab validates BIMI records used to display your brand logo in supported inboxes.

1. Enter your domain and select Validate BIMI.
2. DNS Checker retrieves the BIMI record and shows:

• The record value
• Declared tags and their meaning
• Details about the VMC (Verified Mark Certificate), if present
• It confirms whether the BIMI record is valid.

Why this is useful

• Ensures BIMI is correctly set up so your logo can appear in compatible email clients.
• Helps keep your BIMI configuration compliant with BIMI standards.
• Supports brand recognition and trust in recipients’ inboxes.

Validation Results and Detail Views

For each record type (DMARC, SPF, DKIM, BIMI), DNS Checker provides detailed results pages. 

You can see whether the record is valid or invalid, a breakdown of:

• Declared and defaulted tags
• Policies and alignment modes (DMARC and DKIM)
• DNS lookups and mechanisms (SPF)
• VMC details and BIMI configuration (BIMI)