# SecLens.ONE

> SecLens.ONE assesses SPF, DKIM, DMARC, MTA-STS, TLS-RPT, DANE and DNSSEC for public domains. BIMI is shown and not scored. Scoring rules and engine are open source.

## Assessment

- [SecLens.ONE](https://seclens.one/): Free email and domain security assessment tool checking SPF, DMARC, DKIM, DNSSEC, MTA-STS, DANE and TLS-RPT against live public DNS data. BIMI is shown and not scored.
- [Methodology](https://seclens.one/methodology/): How SecLens.ONE scores email security: the point weights and rules for SPF, DMARC, DKIM, MTA-STS, TLS-RPT, DANE, DNSSEC and the Null-MX profile.
- [DMARC checker](https://seclens.one/dmarc-checker/): Check the live DMARC record for any domain: p=, sp=, pct=, syntax, and whether reporting is configured. Same SecLens.ONE assessment as the full score.
- [SPF checker](https://seclens.one/spf-checker/): Look up the live SPF record: include chain, DNS lookup count, and whether the terminator is -all or ~all. Same SecLens.ONE assessment as the full score.
- [DKIM checker](https://seclens.one/dkim-checker/): Discover live DKIM selectors for a domain and see which keys are production, test-only, revoked, or weak. Same SecLens.ONE assessment as the full score.
- [MTA-STS checker](https://seclens.one/mta-sts-checker/): Check MTA-STS for a domain: _mta-sts DNS, HTTPS policy fetch, mode, and MX coverage. Same SecLens.ONE assessment as the full score.
- [DANE checker](https://seclens.one/dane-checker/): Look up DANE TLSA records for each MX host and whether DNSSEC validation was observed. Same SecLens.ONE assessment as the full score.
- [TLS-RPT checker](https://seclens.one/tls-rpt-checker/): Check the live TLS-RPT record at _smtp._tls and whether reporting is configured. Same SecLens.ONE assessment as the full score.
- [Email security score](https://seclens.one/email-security-score/): Get a live 0-100 email security score for any domain across SPF, DMARC, DKIM, DNSSEC, MTA-STS, DANE, and TLS-RPT. Free, no account.
- [Email spoofing check](https://seclens.one/email-spoofing-check/): See whether a domain can be spoofed: live DMARC enforcement first, then the rest of the email-security stack. Free SecLens.ONE check, no account.

## Research

- [Research](https://seclens.one/research/): Recurring measurement reports on the state of email security across the Cloudflare Radar Top 1 Million domains: SPF, DKIM, DMARC, MTA-STS, TLS-RPT, DANE, DNSSEC and Null MX. Aggregated figures are licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) with attribution to SecLens.ONE. Raw per-domain evidence is available on reasonable request.
- [Email Security Across the Top 1 Million Domains, October 2026](https://seclens.one/research/2026-10-email-security-top1m/): 69.1% of mail-enabled Top 1M domains are spoofable, down from 70.9% in July. Most of that move is one parked-domain portfolio. 1,000,000 domains.
- [The Fake Email Problem, October 2026](https://seclens.one/research/2026-10-email-security-plain-english/): Could a criminal send email in your company’s name? Still yes for 7 in 10 mail-enabled top domains. October 2026, compared with July.
- [Email Security Across the Top 1 Million Domains](https://seclens.one/research/2026-07-email-security-top1m/): 70.9% of mail-enabled Top 1M domains are spoofable. SecLens.ONE measured SPF, DKIM, DMARC, MTA-STS, TLS-RPT, DANE and DNSSEC across 1,000,050 domains.
- [The Fake Email Problem, Explained](https://seclens.one/research/2026-07-email-security-plain-english/): Could a criminal send email in your company’s name? For 7 in 10 top domains, yes. The July 2026 SecLens.ONE study retold in plain English.

## Operator

- [Company](https://seclens.one/company/): SecLens.ONE is operated by 42Sec PTE. LTD. (UEN 202557039H), Singapore. Entity details, registered office, what SecLens.ONE is, and the open-source code.
- [What we store](https://seclens.one/privacy/): What an assessment stores, what the network layer records, how public results are listed, and how long things are kept.

## API

- [SecLens.ONE public assessment API](https://seclens.one/openapi.json): Public email-security assessments. No OAuth. Operator ingest and ops paths are not part of this document.
- [SecLens.ONE MCP server](https://seclens.one/.well-known/mcp/server-card.json): Assess a domain's public email-security posture and read stored SecLens.ONE results.
- [SecLens.ONE assess skill](https://seclens.one/.well-known/agent-skills/seclens-assess/SKILL.md): Assess a domain's public email-security posture (SPF, DKIM, DMARC, MTA-STS, DANE, DNSSEC, TLS-RPT, and informational BIMI) with the SecLens.ONE HTTP API. BIMI does not change the score.