Does this tool access my email or systems?

No. It only reads public DNS records that anyone on the internet can look up. It doesn't log in to anything, read any email, or send anything to your domain.

How is the grade calculated?

DMARC and SPF carry the most weight, followed by DKIM and your mail server records. DNSSEC, CAA, MTA-STS, TLS-RPT, and BIMI are hardening steps that add a little on top. A few serious problems, like broken DNSSEC, more than one SPF record, or no DMARC at all, cap the grade at D no matter how the rest scores. If we can't confirm DKIM, it may still be set up correctly, since we can only check the most common settings.

What do the other checks look at?

MX records tell the world where to deliver your email. Nameservers answer for your domain, and you need at least two that work. DNSSEC signs your DNS records so they can't be quietly altered, and CAA limits which companies can issue security certificates for your domain. MTA-STS requires other mail servers to deliver your email over an encrypted connection, and TLS-RPT tells you when that fails. BIMI puts your logo next to your messages in supported inboxes once DMARC is enforced.

My grade is low. Does that mean I've been hacked?

No. A low grade means your domain is easier to impersonate, not that anyone has accessed your systems. Most gaps can be fixed with a few DNS changes, and your emailed report explains each one. If you'd like help, schedule an IT Environment Review and we'll walk through it with you.

I got an A. Is there anything left to do?

Your core protection is in good shape, and your report notes any optional improvements. Recheck whenever you change email providers or add a service that sends email for you, like a newsletter or billing platform, and at least once a year.

Why do you email the full report instead of showing it here?

The full report includes the specific records we found and step-by-step fixes for your email platform. Sending it by email makes it easy to forward to whoever manages your IT.

Free tool

Email Security Check

Find out how easy it would be for someone to send email pretending to be your company. Enter your domain for a free grade in about 10 seconds, then get the full report with fixes by email.

What we check

Spoofing protection

SPF, DKIM, and DMARC, the records that stop someone sending as you. Plus BIMI, if you want your logo in the inbox.

Mail delivery

MX, MTA-STS, and TLS-RPT, which control where your email goes and whether it travels encrypted.

Domain security

Nameservers, DNSSEC, and CAA, which keep your domain answering correctly and limit who can issue certificates for it.

Why it matters

What spoofing and impersonation actually look like

Email spoofing is when someone sends a message that appears to come from your domain without having access to your email at all. They don't need to hack you. If your domain isn't set up to prove which email is legitimate, they can simply put your address in the "from" line and hope the receiving server accepts it.

Here's what that tends to look like in practice:

A client receives an invoice from "your" accounting address with new bank details, and pays it.
A vendor gets a request from "your" owner to update payment information or send a wire.
Your employees receive a message from "your" IT or HR address asking them to log in somewhere or open an attachment.
Your real email starts landing in spam folders, because receiving servers can't tell your legitimate messages apart from fakes.

The damage usually doesn't land on you first. It lands on your clients, vendors, and staff, who trusted the message because it had your name on it. That's why email authentication is increasingly on cyber insurance questionnaires, and why major email providers like Google, Yahoo, and Microsoft now expect businesses that send email at volume to have it in place.

In plain language

The three records that do most of the work

SPF

Sender Policy Framework

SPF lists the services allowed to send email for your domain. Receiving servers check that list when a message claims to be from you. Think of it as a guest list at the door.

DKIM

DomainKeys Identified Mail

DKIM adds a digital signature that receiving servers check against your domain. A match confirms that the message came from you and was not changed along the way. Think of it as a tamper-evident seal on an envelope.

DMARC

Domain-based Message Authentication, Reporting and Conformance

DMARC ties SPF and DKIM together and tells receiving servers what to do when a message fails those checks. It can also report who is sending email using your domain. Think of it as the instructions to security.

The three work as a set. SPF and DKIM prove which email is really yours, and DMARC makes sure the fakes get stopped. The real protection comes from all three being set up correctly, with DMARC set to enforce. The other checks (nameservers, DNSSEC, CAA, MTA-STS, TLS-RPT, and BIMI) harden the domain around them, so they count for a little of your grade.

What this check does and doesn't do

This tool reads your domain's public DNS records, the same information any mail server in the world can see. It doesn't access your email, accounts, or systems, and it doesn't send anything to your domain.

It also can't see everything. DKIM can only be checked on common settings, so a custom setup may not show up here even if it's working. And the controls that do most of the real protecting, like multifactor authentication, tested backups, and how accounts are managed, aren't visible from the outside at all. That's what the free IT Environment Review is for.

Schedule an IT Environment Review Check your domain

Common questions