Free tool

Email Security Check

Find out how easy it would be for someone to send email pretending to be your company. Enter your domain for a free grade in about 10 seconds, then get the full report with fixes by email.

What we check

Spoofing protection

SPF, DKIM, and DMARC, the records that stop someone sending email as you. These drive your grade.

Mail delivery

MX records and nameservers, which make sure email and your domain keep working. Problems here also count toward your grade.

Optional hardening

DNSSEC, CAA, MTA-STS, TLS-RPT, and BIMI. We report them with context, but they don't affect your grade.

Why it matters

What spoofing and impersonation actually look like

Email spoofing is when someone sends a message that appears to come from your domain without having access to your email at all. They don't need to hack you. If your domain isn't set up to prove which email is legitimate, they can simply put your address in the "from" line and hope the receiving server accepts it.

Here's what that tends to look like in practice:

A client receives an invoice from "your" accounting address with new bank details, and pays it.
A vendor gets a request from "your" owner to update payment information or send a wire.
Your employees receive a message from "your" IT or HR address asking them to log in somewhere or open an attachment.
Your real email starts landing in spam folders, because receiving servers can't tell your legitimate messages apart from fakes.

The damage usually doesn't land on you first. It lands on your clients, vendors, and staff, who trusted the message because it had your name on it. That's why email authentication is increasingly on cyber insurance questionnaires, and why major email providers like Google, Yahoo, and Microsoft now expect businesses that send email at volume to have it in place.

In plain language

The three records that do most of the work

SPF

Sender Policy Framework

SPF lists the services allowed to send email for your domain. Receiving servers check that list when a message claims to be from you. Think of it as a guest list at the door.

DKIM

DomainKeys Identified Mail

DKIM adds a digital signature that receiving servers check against your domain. A match confirms that the message came from you and was not changed along the way. Think of it as a tamper-evident seal on an envelope.

DMARC

Domain-based Message Authentication, Reporting and Conformance

DMARC ties SPF and DKIM together and tells receiving servers what to do when a message fails those checks. It can also report who is sending email using your domain. Think of it as the instructions to security.

The three work as a set. SPF and DKIM prove which email is really yours, and DMARC makes sure the fakes get stopped. The real protection comes from all three being set up correctly, with DMARC set to enforce. The other settings we check are optional hardening. They don't affect your grade, and your report explains when each one is worth doing.

What this check does and doesn't do

This tool reads your domain's public DNS records, the same information any mail server in the world can see. It doesn't access your email, accounts, or systems, and it doesn't send anything to your domain.

It also can't see everything. DKIM can only be checked on common settings, so a custom setup may not show up here even if it's working. And the controls that do most of the real protecting, like multifactor authentication, tested backups, and how accounts are managed, aren't visible from the outside at all. That's what the free IT Environment Review is for.

Schedule an IT Environment Review Check your domain

Common questions

Email security questions

How do I check if my domain has SPF, DKIM, and DMARC set up?

Enter your domain in the Email Security Check above. It looks up your domain's public DNS records and grades SPF, DKIM, DMARC, and the settings around them in about 10 seconds. It only reads public information, so it doesn't access your email or systems. DKIM can only be checked on common settings, so a custom setup may not show up even if it's working.

Can someone send email pretending to be my company?

Yes, if your domain isn't set up to prove which email is really yours. Without SPF, DKIM, and a DMARC policy set to quarantine or reject, someone can put your address in the "from" line and many receiving servers will accept it. Setting all three up correctly is what stops it, and most of the work is a few DNS changes.

Is a DMARC policy of p=none enough?

No. A DMARC policy of p=none only monitors. It sends you reports, but it tells receiving servers to deliver failing messages anyway, so spoofed email still gets through. It's the right place to start while you confirm every legitimate sender is covered, and then you move to p=quarantine and p=reject.

What is a good email security score?

On this check, an A means SPF, DKIM, and DMARC are all in place with DMARC enforced, and your mail records work. The grade is based only on those core records. Optional settings like DNSSEC, CAA, MTA-STS, and BIMI are reported with context but don't change the grade. Serious problems, like no DMARC, more than one SPF record, or broken DNSSEC, cap the grade at D. Recheck whenever you change email providers or add a service that sends email for you, and at least once a year.

Does a low email security score mean I've been hacked?

No. A low score means your domain is easier to impersonate, not that anyone has accessed your systems. Most gaps can be fixed with a few DNS changes, and the full report explains each one. If you'd like help, schedule an IT Environment Review and we'll walk through it with you.

Do I need DNSSEC, MTA-STS, CAA, or BIMI for email security?

Not to be well protected. SPF, DKIM, and DMARC do the work of stopping spoofing. Some email security tools score the others heavily, which can make a well-protected domain look worse than it is. DNSSEC guards DNS records against tampering, but a misconfiguration can take your domain offline, so many organizations choose not to use it. MTA-STS enforces encrypted delivery but needs careful upkeep. CAA is a small, simple safeguard for certificates. BIMI shows your logo in supported inboxes and adds no security. Your report explains when each one is worth doing.