DNS and email posture: SPF, DMARC, DNSSEC and transport

Publishing an SPF record is not the same as having one that works. Buteo evaluates the rules the way a receiving server would.

Most tools confirm a record exists. The useful question is a different one: if somebody sends mail pretending to be your domain, does this configuration stop the message? Buteo resolves the SPF record in full, counts the DNS lookups it forces and tells you whether it blows the limit that makes it invalid, checks whether the DMARC policy is merely observing or actually rejecting, confirms whether the DNSSEC chain signs all the way to the root or breaks halfway, and tests whether your mail servers accept TLS and at what quality. It also checks whether the zone will hand its full contents to anyone who asks, which is an old and still common way to give away an organisation's entire inventory.

What Buteo audits

• ✓SPF record resolved in full, with lookup count and duplicate-record detection
• ✓DMARC policy, alignment and where the reports go
• ✓DNSSEC chain from the root down to the domain
• ✓Mail transport: TLS offered by the MX hosts and the quality of the negotiation
• ✓Zone transfer open to third parties
• ✓CAA records and who may issue certificates in your name