Free tool
Email security checker
Can attackers send email that looks like it came from you? Check your domain's SPF, DKIM and DMARC in seconds — with a grade and exactly what to fix.
We only read public information — the same thing anyone on the internet can see. Nothing is stored and we will not contact you.
What we check
Five records that decide who can send as you
- SPF
- Lists the mail servers allowed to send for your domain. We check it exists, is unique, ends in -all or ~all and stays under the 10-lookup limit.
- DMARC
- Tells receivers what to do with mail that fails SPF and DKIM. We check the policy (none, quarantine or reject), coverage and whether you receive reports.
- DKIM
- A digital signature on every message. We look for keys at the selectors used by Microsoft 365, Google Workspace and common email platforms.
- MX
- Where your email is delivered. We identify the provider so the advice fits your setup.
- MTA-STS
- Forces other mail servers to use encrypted connections when delivering to you. A bonus control most domains have not set up yet.
FAQ
Common questions
What is SPF, DKIM and DMARC?
SPF lists the servers allowed to send email for your domain. DKIM adds a cryptographic signature to each message so receivers can tell it was not altered. DMARC ties the two together and tells receivers what to do with mail that fails — deliver it, send it to spam (quarantine) or block it (reject). You need all three to stop attackers sending email that looks like it came from you.
What DMARC policy should I use?
Start with p=none and a rua= reporting address so you can see who sends mail as your domain. Once every legitimate sender passes SPF or DKIM, move to p=quarantine and then p=reject. Only quarantine and reject actually stop spoofed email.
Why does the checker say DKIM was not found when I have it set up?
DKIM keys live at a 'selector' that only your email provider knows. We test the common selectors used by Microsoft 365, Google Workspace and popular email platforms. If you use a different selector, your DKIM may be fine — check the selector in your email provider's admin console.
Is it safe to check my domain here?
Yes. The checker only reads public DNS records — the same records every email server in the world reads when you send them a message. It does not connect to your mail server or send any email, and we do not store the domains you check.
Does a good score mean my email is secure?
It means attackers will find it much harder to impersonate your domain. It does not cover phishing sent to you from other domains, compromised mailboxes or missing MFA. Our email protection and Microsoft 365 security assessment cover those.
More free tools
Need your DMARC fixed?
We set up SPF, DKIM and DMARC for Microsoft 365 and Google Workspace, monitor the reports and take you to p=reject without losing legitimate mail.