Email Security Checker
Enter your domain to instantly check its SPF, DKIM, and DMARC records - the DNS settings that stop someone else sending forged email pretending to be your business.
Runs entirely via public DNS lookups in your browser - nothing about your domain is sent to us or stored.
Why This Matters
Email doesn't verify who actually sent it by default - anyone can type your domain into the “From” field of an email unless your DNS records say otherwise. SPF, DKIM, and DMARC are the three records that close that gap, and they're why a fake invoice email claiming to be from your business either gets blocked or lands safely in a spam folder instead of a client's inbox.
Most businesses on Microsoft 365 or Google Workspace assume this is handled automatically. It isn't - both platforms sign their own outgoing mail, but a custom SPF record, your own DKIM configuration, and a DMARC policy for your domain all have to be added manually as DNS records.
FAQs
What are SPF, DKIM, and DMARC?
They're DNS records that let receiving mail servers verify an email genuinely came from your domain. SPF lists which servers are allowed to send on your behalf, DKIM cryptographically signs outgoing mail, and DMARC tells receiving servers what to do with mail that fails those checks. See our full guide to SPF, DKIM, and DMARC for the plain-English version.
Why didn't this tool find my DKIM record?
DKIM selectors (the name in front of "._domainkey") are provider-specific and there's no way to discover the exact one via DNS without already knowing it. This tool checks the most common selector names, but a "not found" result isn't conclusive - check your mail provider's admin panel directly to confirm DKIM signing is enabled.
Is this accurate?
It reads your domain's live public DNS records directly, so the SPF and DMARC results are accurate as of the moment you run the check. What it can't see is your mailbox-level security, spam filtering, or whether your provider is actually signing mail with DKIM behind the scenes.
Is my domain or any information stored?
No. The check runs in your browser using a public DNS lookup service - nothing about your domain or the results is sent to us or saved anywhere unless you choose to contact us afterwards.
We got a warning - how urgent is it to fix?
A missing DMARC record or an SPF record with no enforcement (no ~all or -all) means anyone can currently forge an email that looks like it's from your domain - a common technique in invoice fraud and business email compromise. It's worth fixing promptly rather than leaving it as background risk.
Found gaps in your email security?
We'll set up and correctly configure SPF, DKIM, and DMARC for your domain - and make sure it doesn't break your mail flow in the process.