Email security checker
Email authentication audit
Can someone send email as your domain?
Enter a domain to read its SPF, DMARC, DKIM, MTA-STS and BIMI records live from DNS and grade them. Nothing is stored and no email is sent.
Works with any domain: a company domain, a personal one, or a parked domain that should never send mail.
SPF, DKIM and DMARC in one minute
- SPF
- SPF lists the servers allowed to send mail for your domain. Receivers compare the sending server against that list.
- DKIM
- DKIM signs every outgoing message with a key published in your DNS, so receivers can tell it was not altered or forged.
- DMARC
- DMARC tells receivers what to do when a message fails SPF and DKIM (nothing, spam folder or reject) and sends you reports about it.
How the grade works
Records are read live from public DNS and checked against RFC 7208 (SPF), RFC 7489 (DMARC) and RFC 8461 (MTA-STS). Each critical problem costs 30 points, a warning 15 and an improvement 5. DKIM keys can only be found when the selector is known, so "none found" means none of the common selectors answered, not that the domain has no DKIM.