Free tool
Can criminals send email as your domain?
Check SPF, DKIM and DMARC for any domain in seconds. You get a grade, what it means in plain English, and the exact records to fix it.
Uses public DNS only. We store the domain and the result (not your IP address) for 90 days to prevent abuse.
What this checks
- SPF: which servers may send email for your domain, and whether the record breaks the 10-lookup limit.
- DKIM: whether your email is signed (we check the common selectors used by Microsoft 365, Google Workspace and popular senders).
- DMARC: whether receivers are told to junk or reject email that pretends to be you. This is what actually stops fake invoices sent "from" your domain.
- MX, MTA-STS and TLS reporting: where your mail goes and whether delivery is forced to be encrypted.
Learn more: How to stop invoice and payment-change scams.
Find out where your email is exposed.
Then close the gaps.
Tell us your provider and mailbox count for a written quote, or grade your domain for free right now.