Can someone send email pretending to be you?
Check your domain's SPF, DKIM, DMARC, MTA-STS, TLS-RPT, BIMI and DNSSEC in seconds. Get a grade, a plain-English explanation and the exact records to fix it.
- Free, no sign-up
- Results in seconds
- 8 standards checked
- Email yourself the report
Eight checks. One clear grade.
Every check runs against your live public DNS, the same records Gmail, Microsoft and every other mail server look at when your email arrives.
DMARC
Your policy for forged mail: monitor, quarantine or reject. We check the policy, reporting and subdomain coverage.
SPF
Which servers may send as you. We validate syntax, count DNS lookups against the limit of 10 and list your senders.
DKIM
The cryptographic signature on your mail. We probe 70+ common selectors and check key strength.
MX records
Where your email is delivered. We confirm your mail servers resolve and identify your email platform.
MTA-STS
Forces other servers to encrypt mail sent to you. We fetch your policy file and check it covers every MX host.
TLS-RPT
Reports when encrypted delivery to you fails, so certificate or policy problems don't go unnoticed.
DNSSEC
Signs your DNS so attackers can't forge your mail records. Validated live through a DNSSEC-aware resolver.
BIMI
Your logo beside your emails in Gmail, Yahoo and Apple Mail. A bonus once DMARC is enforcing.
Spoofing your domain takes no hacking at all.
Email was designed without any way to prove who sent a message. SPF, DKIM and DMARC were added later to fix that, but they only protect you if they’re published and set up correctly, and most small businesses have gaps.
When your domain isn’t protected, an attacker can send a message from accounts@yourcompany.com to your clients asking them to update your banking details, and it will look completely genuine. You won’t see it, because it never touches your systems.
- Invoice and payment fraudBusiness email compromise is one of the costliest cybercrimes for small businesses, and spoofed domains make it easy.
- Phishing your own staffFake messages "from the CEO" or "from IT" get past people because the address looks right.
- DeliverabilityGmail, Yahoo and Microsoft now junk or reject mail that fails authentication, including your genuine invoices and proposals.
- Insurance and complianceCyber insurers and client security questionnaires increasingly ask whether you enforce DMARC.
Gmail, Yahoo and Microsoft now require it.
Email authentication used to be best practice. For anyone who sends at volume it’s now mandatory, and the bar keeps rising for everyone else.
Gmail and Yahoo, February 2024
Every sender needs SPF or DKIM. Anyone sending 5,000+ messages a day to Gmail needs SPF, DKIM and DMARC, with the From domain aligned, plus one-click unsubscribe on marketing mail.
Microsoft Outlook.com, May 2025
High-volume senders to Outlook.com, Hotmail and Live addresses must pass SPF, DKIM and DMARC (at least p=none). Non-compliant mail is junked, then rejected.
Everyone else
Even if you send far less, these rules set the bar. Mailbox providers increasingly treat unauthenticated mail as suspicious, so it lands in spam.
How to read your result.
- A: 90 to 100Spoofing is blocked and your setup follows current best practice. Keep monitoring DMARC reports.
- B: 75 to 89Spoofing is blocked, with secondary protections (MTA-STS, DNSSEC, key strength) to tighten.
- C: 60 to 74Real weaknesses. Often DMARC is still in monitor-only mode, so forged mail gets delivered.
- D: 45 to 59A core protection is missing, usually DMARC or SPF. Your domain can be spoofed today.
- F: below 45Little or no protection, or records so broken that receivers ignore them.
- How the score worksOut of 100: DMARC, SPF, DKIM and your mail servers (MX) are worth 90 points together. MTA-STS adds 3, TLS reporting 2 and DNSSEC 5. BIMI is shown as a tip but isn't scored.
Four steps to a domain nobody can fake.
Check
Run the free check and email yourself the report.
Prioritise
Start with "Fix these first": DMARC, SPF and DKIM before anything else.
Fix
Publish the records we give you, or let our engineers do it with zero disruption to your mail.
Monitor
Watch DMARC reports for 2 to 4 weeks, then move to quarantine and reject with confidence.
Is the email security check really free?
Yes. There's no sign-up and no limit for normal use. You only give us your email address if you want the report sent to you.
What information do you collect?
Only your domain name, which we look up in public DNS. Nothing is installed, and we never send email from or to your domain during the check. If you ask for the report by email, we keep your address to send it and to follow up on that report only, unless you opt in to tips.
Why can't you find my DKIM key?
DKIM keys are published under a name called a selector, which every provider chooses differently, and DNS doesn't let anyone list them. We try more than 70 common selectors. If yours is custom, enter it under "Advanced" and check again.
How long do DNS changes take to show up?
Usually minutes, sometimes up to an hour or two depending on your DNS host and the record's TTL. Results are cached for 10 minutes, so wait a little before re-checking.
Will moving DMARC to "reject" stop my own email?
It can, if a service that sends on your behalf (a CRM, newsletter tool or website form) isn't authenticated. That's why we start at p=none, read the reports, fix every legitimate sender, and only then enforce.
Can you set this up for us?
Yes. Our engineers implement SPF, DKIM, DMARC, MTA-STS and TLS-RPT for businesses across Toronto and the GTA, and monitor DMARC reports so nothing breaks. Call 416.235.0931 or book a free review below.
Want an engineer to fix it for you?
Send us your report or book a free 20-minute review. We'll tell you exactly what to change, or simply do it for you.
Tell us about your IT.
We answer almost every inquiry within one business day.