Test SPF, DKIM, DMARC and MX records on any domain, with the real record values and a plain-English verdict on whether someone can spoof your email.
Email security for a domain comes down to three DNS records that decide who is allowed to send mail using your name: SPF, DKIM and DMARC. Without them, the From address on an email is nothing more than a label anyone can type, which is exactly why phishing works. With them, receiving servers can check every message against rules you publish and throw away anything that fails. This email security checker reads all three records live from DNS, along with your MX (mail server) records, and reports each one with the real value and a verdict instead of a raw dump of jargon.
A Sender Policy Framework record is a DNS TXT entry that starts with v=spf1 and lists the servers and services permitted to send email for your domain, such as your mail host, your newsletter platform, and your help desk. It ends with an all mechanism that says what to do with everyone else: -all is a hard fail that rejects them, ~all is a soft fail that flags them, and +all is a mistake that lets the entire internet send as you. The checker reads your record, names the third-party senders it finds, and flags a weak or missing all mechanism.
DomainKeys Identified Mail adds a cryptographic signature to every message you send and publishes the matching public key in DNS at a named selector. Receivers use it to confirm the mail really came from your systems and was not tampered with in transit. Because a selector name can be anything, the tool probes the common ones and detects the traps a naive check misses: a wildcard record that answers every query, a revoked key with an empty p= value, and a key still in testing mode.
DMARC is the record that turns SPF and DKIM from advisory checks into an enforced policy. Its p= tag tells receiving servers what to do with mail that fails: none only watches and reports, quarantine sends failures to spam, and reject blocks them outright. A rua address collects the daily aggregate reports that show you who is sending as your domain. The checker reads your policy and tells you whether it is monitoring only or actually enforcing.
The most spoofed domains are often the ones that never send email at all, because their owners assume authentication is only for senders. It is the opposite: a non-sending domain is the easiest to lock down completely. Publish v=spf1 -all and v=DMARC1; p=reject and you have told every mail server on earth that no one is allowed to send as you and anything claiming to should be rejected. A stranger cannot then send a phishing email that looks like it came from your brand. This tool detects that locked-down posture and credits it, rather than nagging you for records you were told you did not need.
If your website sits behind a CDN like Cloudflare, the whole point is to hide the real server address so attackers cannot bypass the protection and hit the origin directly. SPF and MX records routinely publish that address in plain sight without anyone noticing. When the scanned domain is behind a CDN, this checker compares the IPs in your DNS against your web server address and warns you if the origin is exposed, which no other email checker does.
An email security checker reads the DNS records that protect a domain from email spoofing: SPF, DKIM, DMARC and MX. It confirms each one exists and is configured correctly, then tells you in plain English whether a stranger could send phishing that appears to come from your domain.
SPF lists which servers may send mail as your domain. DKIM adds a signature that proves a message was not altered on the way. DMARC ties the two together and tells receiving servers what to do when a message fails, plus where to send reports. You need all three for full protection.
Yes, and it is the easiest domain to protect. Publish v=spf1 -all and v=DMARC1; p=reject. That tells the world no server is allowed to send as you and receivers should reject anything that claims to, which stops your domain being used in phishing even though it sends no mail of its own.
If your domain has no DMARC record, or a DMARC policy of p=none, receiving servers are never told to reject forged mail, so anyone can spoof your From address. A missing SPF record makes it worse. Run the checker: an Exposed verdict means spoofing is possible right now.
Indirectly but seriously. If attackers spoof your domain in phishing, recipients and spam filters lose trust in mail from you, which hurts deliverability for real newsletters and outreach. A domain flagged for abuse also erodes the brand-trust signals search engines and users rely on. Locked-down authentication is cheap protection for both.
Yes. Enter any domain and get the full SPF, DKIM, DMARC and MX report with a plain-English verdict at no cost, with no sign up.