DigitalBanzai Knowledge

Email Service Indicators

Practical guide to the observable email-related signals the scanner detects today and when they justify a closer configuration review.

Italian version
Severity
Informational
Estimated fix time
10-30 min
Technical level
Beginner / Intermediate
Applies to
DNSEmail hostingWordPressStatic SitesCMS / E-commerce

Quick Answer

The Email Service Indicators check in the report detects publicly observable signals that suggest the analyzed domain is using email-related services.

Unlike the Email Security module, which focuses on SPF and DMARC checks, this indicator looks at a broader set of signals: MX records, SPF and DMARC presence, best-effort DKIM detection, mailto links, and possible contact forms.

The goal is not to decide whether email sending is fully working. The goal is to understand whether the domain shows enough email-related signals to justify a closer review of the configuration.

What it is

During the page and domain analysis, the scanner gathers several externally visible signals:

  • MX records, which show whether the domain is configured to receive email;
  • SPF, when a DNS record is present declaring the servers allowed to send email for the domain;
  • DMARC, when a DNS policy is present for handling messages that fail authentication checks;
  • DKIM, detected in best-effort mode through common selectors;
  • mailto links, meaning links such as mailto:info@example.com;
  • contact forms, when the page structure suggests a contact form is present;
  • status code and final URL, which help contextualize the page that was actually analyzed.

These signals are then summarized into a level, a score, and a list of detected signals.

Why it matters

If a site shows multiple signals associated with email usage, the domain is likely involved in communication with users, customers, or visitors.

This does not automatically mean there is a problem. It does mean the email setup deserves attention, because SPF, DKIM, and DMARC help protect the domain's identity and reduce the risk of misuse or inconsistent configuration.

The check is especially useful for sites that rely on contact forms, newsletters, CRM tools, ecommerce flows, booking systems, or external services that send messages on behalf of the domain.

How this is checked

The scanner runs a preliminary check based on publicly observable signals. In practice, it looks for:

  • MX records;
  • an SPF record;
  • a DMARC record;
  • best-effort DKIM traces detected through common selectors;
  • mailto links on the page;
  • elements compatible with a contact form;
  • the status code and final URL of the analyzed page.

The result is then summarized into an Indicator Level, an Indicator Score, and a list of Detected signals.

The DKIM case needs to be read carefully. The scanner tries to detect DKIM records using common selectors, but many domains use custom selectors defined by the email provider, newsletter platform, or SMTP service.

Because of that, if the scanner does not detect DKIM, the result should not be treated as definitive proof that DKIM is absent. It should be treated as a signal worth checking manually in the email provider panel, the DNS zone, or the documentation for the service that sends mail for the domain.

Possible findings

Indicator level: Low

the report found few observable signals associated with email services. That may mean the domain uses email only lightly, that the analyzed page exposes few visible clues, or that the email setup is not easy to observe from the outside.

Indicator level: Moderate

the report found some signals consistent with email usage. In that case, it can be worth checking in an orderly way which services send or receive email for the domain.

Indicator level: High

A High level does not mean the site is dangerous, vulnerable, or compromised. It means the scanner detected several observable signals connected to email usage.

The higher the level, the more reasonable it is to prioritize a review of the email configuration, especially when the domain is used for professional, commercial, or automated communication.

Indicator score and detected signals

The Indicator Score is an internal score based on the combination of the detected signals. A higher score means the report found more elements connected to email usage.

The score does not measure configuration quality, deliverability, or domain reputation. Its main purpose is prioritization: when many signals are present, it is worth checking that SPF, DKIM, DMARC, and sending services are configured consistently.

In the report, the scanner also shows the signals that contributed to the indicator. The most common are:

  • mx: the domain has mail servers configured for receiving email;
  • spf: an SPF record is present;
  • dmarc: a DMARC record is present;
  • dkim: the scanner detected a DKIM record through one of the tested common selectors;
  • mailto: one or more direct email links are present on the page;
  • contact_form: the page contains elements compatible with a contact form.

This list helps explain why the scanner assigned a given level.

If the indicator shows a High level, it is wise to perform an orderly review of the email configuration.

The most useful actions are:

  • check that SPF is present and includes every authorized sending service;
  • check that DMARC is present and consistent with the real use of the domain;
  • review DKIM in the email provider or SMTP service panel;
  • identify every system that sends email on behalf of the domain;
  • review forms, newsletters, CRM tools, plugins, ecommerce systems, and automations;
  • avoid random DNS changes or rushed overwrites of existing records;
  • document which services are authorized to send email.

The goal is not to change everything immediately. The goal is to understand whether the current configuration really reflects how the domain is being used.

How to fix it

The Email Service Indicators module does not perform a full email audit. It is meant as a preliminary indicator that helps you decide whether deeper review is justified.

It does not verify:

  • real deliverability;
  • IP reputation;
  • blacklists;
  • active spoofing tests;
  • advanced mail-gateway configuration;
  • delivery rates;
  • open rates;
  • actual sending of test messages.

Its purpose is to help determine whether the domain shows enough signals to justify a proper review of the email setup.

WordPress

On WordPress, email-related signals are common.

A WordPress site may send email through contact forms, WooCommerce, booking plugins, membership systems, newsletters, automatic notifications, or SMTP plugins.

In these cases, the most important point is understanding who is actually sending the email.

If the site uses the hosting provider for mail, SPF needs to account for that provider. If it uses an external SMTP service, that service must be authorized. If it relies on newsletter, CRM, or external platforms, those tools also need to be reflected in the configuration.

Static sites

A static site can also show email-related signals.

A site built with HTML, Astro, or deployed through a CDN may still contain mailto links, forms handled by third-party services, newsletter signups, or automations connected to external providers.

In those cases, the scanner may detect email-related signals even though the site has no traditional backend.

SPF, DKIM, and DMARC still belong to the domain configuration, not to the technology used to build the site.

How it appears in the report

In the report, the check shows a compact summary, a level, a score, the list of detected signals, and a Technical details block.

Example of the summary currently visible:

Email Service Indicators
Signals commonly associated with email services were detected. Several observable signals commonly associated with email services were detected.
Indicator level: High
Indicator score: 5
Detected signals: mx, spf, dmarc, mailto
Prioritize an email security configuration review and validate SPF, DKIM, and DMARC carefully.

Example of technical details currently observable:

{
  "url": "https://example.com",
  "domain": "example.com",
  "signals": [
    "mx",
    "spf",
    "dmarc",
    "mailto"
  ],
  "signal_details": {
    "mx_present": true,
    "spf_present": true,
    "dmarc_present": true,
    "dkim_detected": false,
    "dkim_detection_note": "Only common DKIM selectors were tested. Absence of detection is not evidence of absence.",
    "mailto_links_found": 1,
    "contact_form_detected": false
  },
  "level": "high",
  "score": 5,
  "mx": {
    "enabled": true,
    "records": [
      "mail.example.com"
    ]
  },
  "spf": {
    "enabled": true,
    "record": "v=spf1 include:spf.example.com ip4:192.0.2.10 -all"
  },
  "dmarc": {
    "enabled": true,
    "record": "v=DMARC1; p=none; rua=mailto:report@example.com"
  },
  "dkim": {
    "enabled": false,
    "selector": null,
    "record": null
  },
  "mailto_links": [
    "mailto:info@example.com"
  ],
  "contact_form_detected": false,
  "status_code": 200,
  "final_url": "https://www.example.com/"
}

This means that the scanner, today, may expose mainly:

  • which observable email-related signals were detected;
  • the level and score assigned to the indicator;
  • the presence of MX, SPF, and DMARC;
  • best-effort DKIM detection with the related cautionary note;
  • possible mailto links and contact-form detection;
  • the status code and final URL of the analyzed page.