About this plugin
InboxAuth helps protect your domain from email spoofing, phishing, and unauthorized email senders with a guided email authentication setup. The plugin scans your domain’s SPF, DKIM, and DMARC DNS records to identify missing configurations, authentication issues, and potential security gaps. Whether you manage a business website, an online store, or a WordPress-powered service, InboxAuth makes it easier to understand and improve your domain’s email security.
Protect Your Domain from Email Spoofing
Without properly configured email authentication, attackers may be able to send fraudulent emails that appear to come from your domain. These spoofed emails can be used for phishing attacks, impersonation, and email-based scams that damage your brand reputation and undermine customer trust. InboxAuth helps you identify weaknesses in your email authentication setup and guides you toward configuring SPF, DKIM, and DMARC records to reduce the risk of domain spoofing and unauthorized email use.
Improve Email Deliverability and Domain Reputation
Properly configured email authentication can help legitimate emails reach recipients more reliably while reducing opportunities for attackers to impersonate your domain. InboxAuth is designed for website owners, developers, businesses, and WordPress administrators who want a simpler way to check SPF, DKIM, and DMARC records, troubleshoot email authentication issues, and improve their domain’s email security.
Take control of your domain’s email authentication with InboxAuth and build a stronger foundation for secure, trustworthy email communication.
- DNS Scan — checks your current SPF, DKIM, and DMARC records.
- Connect Mailbox — validates an IMAP connection to a [email protected]
mailbox that will receive DMARC aggregate reports.
- Set DMARC — walks you through publishing a starter DMARC record
com ) so reports start flowing in.
- Observer Mode — runs a 48-hour window, then automatically parses every DMARC
aggregate report received via IMAP to build a list of everyone sending mail as
your domain.
- Generate Records — once you’ve confirmed which senders are legitimate, generates
a tailored SPF record plus a DMARC record with your choice of quarantine or
reject enforcement, and validates both live via DNS.
The Dashboard gives an at-a-glance view of SPF/DKIM/DMARC status, an overall Email
Security Score, a one-click re-scan, and a link to test whether your domain can
currently be spoofed via the companion Email Authenticity Checker tool.
Requirements
- PHP’s imap extension enabled (for Step 2 / Step 4 mailbox access)
- PHP’s zip extension enabled (Step 4 unpacks.zip-attached DMARC reports)
- Outbound DNS resolution available to the server (standard on virtually all hosts)