Email Security Checker
Find out whether your domain is protected against email spoofing, and what to fix if it isn’t
Lookups go straight from your browser to public DNS (Cloudflare, with Google as a backup). We don’t see or keep the domains you check.
Enter a domain, or paste any email address at that domain.
What These Checks Mean
Three DNS records work together to prove your email is really from you
SPF: The Guest List
A list of the services allowed to send email as your domain, like Microsoft 365, your website, or your newsletter tool. Anything not on the list looks suspicious.
DKIM: The Wax Seal
A digital signature added to every email you send. It proves the message really came from you and wasn’t altered along the way.
DMARC: The Instructions
Tells receiving servers what to do with email that fails SPF and DKIM (deliver it, send it to spam, or block it) and sends you reports.
Common Questions
Why does this matter for a small business?
Without these records, anyone can send email that appears to come from your domain, a favorite trick for fake invoices and payment-change scams aimed at your customers and vendors. Since 2024, Google, Yahoo and Microsoft also expect SPF, DKIM and DMARC from business senders, so missing records can send your real email to spam.
Does running a check change anything?
No. The checker only reads public DNS records, the same information every mail server in the world looks up when you send them an email. Nothing about your domain or email is changed.
Why does DKIM say it wasn’t found when I know it’s on?
DKIM keys live under a name (called a selector) chosen by your email provider, and there’s no way to list them all. We check the names used by the most common providers. If yours uses a custom one, the checker can’t see it, even though DKIM is working fine.
