BCBC Technologies← Back to DexterCheck your mail server. Secure your email.
Choose a server DNS check or an email security walkthrough. See the evidence, understand the limits, and follow the next setup step.
Server DNS checks: This browser can inspect public DNS. SMTP/IMAP ports, server TLS certificates, actual delivery and cryptographic message signatures require separate tests; this page does not claim to verify them.
Check progress
Ready when you are.
Missing a record? Build a draft here.
These tools prepare DNS text for review. They do not change your DNS. Check for an existing record before publishing; edit it instead of creating a duplicate.
Your private key stays private. We do not need or want it—never paste or share it here. This tool only uses your public DNS key. Generator inputs stay in this browser; only DNS names are sent to the lookup service. Publishing records is not a substitute for testing actual outgoing mail.Evidence, without false promises.
This version checks MX, SPF, DMARC, DKIM selectors, A/AAAA, PTR/forward matching and MTA-STS/TLS-RPT discovery records. Bounded selector guessing is best effort, not exhaustive. It flags common record issues and shows the evidence.
It does not send a test email, verify DKIM signatures, evaluate SPF for a sending IP, expand nested SPF lookups, discover inherited DMARC policies, or collect DMARC reports. A record being present is not proof that mail authentication or delivery works. Missing records at a subdomain may be covered by a parent DMARC policy.
Reference: SPF · RFC 7208 · DKIM · RFC 6376 · DMARC · RFC 9989Sign your mail. Encrypt when certificates are available.
A mail server's TLS certificate protects connections. Your personal S/MIME certificate signs messages and lets others encrypt mail for you. DKIM and S/MIME serve different purposes; configuring one does not configure the other.
Signed
A valid digital signature means the signed content matches the signature and the client accepts the signing certificate. Check that the certificate email matches the sender. Mailbox validation does not prove a business claim or job offer is legitimate.
Encrypted
The sender encrypts for the recipient's public certificate. The matching private key decrypts locally. A readable message after decryption can still have traveled encrypted. Subjects and routing metadata may remain visible.
Recipient certificate required: Your personal certificate does not cover a different Gmail address. Exchange signed messages to share public certificates, then verify them before encrypting. Never share your private key or P12 password.
1. Choose a certificate route
Actalis Mailbox Validated: the captured checkout showed the first year free and renewal at €6 plus VAT/year. Confirm current terms before ordering. Actalis's free route supplies a password-protected P12 with a provider-generated key; it does not use the Thunderbird CSR created below.
SSL.com Basic is a paid alternative. Confirm current pricing and acceptance of your existing CSR before paying.
Optional: create a CSR in Thunderbird for an issuer that accepts it
- Open Account Settings → your account → End-To-End Encryption → S/MIME → Generate and save a CSR file.
- Choose a visible local folder and a dated filename without spaces. Our example used RSA 3072 with the email address included.
- The CSR is a request, not an issued certificate. Thunderbird retains its matching private key. Preserve the request and Thunderbird profile.
- Submit the CSR only to a compatible issuer. Follow Mozilla's CSR-specific import instructions for the returned certificate; that workflow differs from importing a complete P12.
2. Actalis request and activation
- Choose Mailbox Validated for the email address you will use. Create an account or sign in.
- Verify your email with the code sent to that mailbox. Enter accurate billing information and review the total and renewal terms.
- Complete the order. In the customer dashboard, choose Activate if the certificate is not yet activated.
- Review the activation terms, then choose Start verification. Once the request is submitted, wait for the issuer's email. “To be verified” is pending, not an active certificate; do not repeat the order.
- After issuance, download the P12/PFX and retain its supplied password securely. If delivered inside a ZIP, extract the ZIP first. A P12 itself is imported, not extracted.
3. Import and assign in Thunderbird
- Open Account Settings → the matching email account → End-To-End Encryption → Manage S/MIME Certificates.
- Under Your Certificates, choose Import, select the P12/PFX, and enter its password privately.
- Return to the account's S/MIME settings. Select the certificate for digital signing and for encryption if its permitted usages support both.
- Run both Test buttons and check the results. Enable Sign unencrypted messages if you want signatures on ordinary outgoing mail.
- If both OpenPGP and S/MIME are configured, choose Prefer S/MIME under Preferred encryption technology if that is your intended default. In each compose window, verify the selected technology.
OpenPGP and S/MIME use separate keys. Turning off OpenPGP does not supply missing S/MIME recipient certificates. Automatic encryption is possible only when valid recipient certificates are available.
4. Run a real signing and encryption test
- Create a message from your certificate's email address to that same address. Use a harmless body such as “Testing S/MIME signing and encryption.”
- Select S/MIME, enable digital signing and require encryption, then send.
- Open the received message in Thunderbird and click its S/MIME security icon.
- PASS requires both a valid digital signature and Message Is Encrypted. A certificate Test button passing alone is not a complete mail test.
- For a second person, exchange signed mail and verify the public certificates first. Then test encrypted mail in both directions.
Common results and what to do
- Cannot find an encryption certificate for the recipient: obtain and verify a certificate for that exact recipient; do not import your own P12 as someone else's identity.
- Signed but not encrypted: signing is separate. Inspect the received security panel and check encryption in the compose window.
- Spam placement: S/MIME does not guarantee inbox delivery. Check the receiving provider's explanation, SPF, DKIM, DMARC and actual sending practices.
- Invalid signature or certificate: stop and read the exact error. Check identity, expiry, certificate chain and clock; do not blindly change trust settings.
Observed example, 2026-10-30: William's Thunderbird self-test displayed a valid digital signature and Message Is Encrypted, using an Actalis certificate. This is evidence for that message; it is not an automated test of your setup.
Your verification checklist
These checkboxes are your own notes; they are not automatic PASS results. They reset when you reload.
Keep the private key after renewal or expiry so you can read older encrypted messages. Set a renewal reminder before expiry. Do not upload certificate bundles or passwords to this checker.
Reference instructions
Mozilla: S/MIME certificate using a CSR · Mozilla: end-to-end encryption setup · Actalis S/MIME FAQ
About · Version · Show file
BCBC Email Server & Security Checker v0.4.0 · 2026-10-30. Includes S-MIME Walkthrough V04. New version; earlier source and guides preserved.
Purpose: public DNS evidence, DNS draft builders and a client security walkthrough. No login, secret upload, DNS mutation or mail sending. DNS queries go to Google Public DNS. Checklist notes stay in this page until you download them; nothing is saved automatically.
Intended live file: /var/www/bcbc/sites/live/bcbc-email-checker.html on Franza CT110. The currently open address is shown below; the intended server path is not proof of deployment.
Site navigation and sponsor footer use the existing site's shared assets. DNS logic is included in this file. A local HTML copy works without site assets, but live DNS requires internet access. No SMTP/IMAP reachability or cryptographic message validation runs here.