Free Email Security Checker
Check public SPF, selected DKIM, DMARC and MX records for a domain. Get a 0–100 configuration score and next checks. Verify real messages before changing your mail policy — no account required.
How the DNS configuration score is calculated
This 0–100 heuristic reflects selected public DNS records. Each protocol contributes a fixed maximum; partial credit is awarded for records with detected issues. It does not prove that real messages pass authentication or that every DKIM selector was tested.
Authorises which servers may send for your domain
Cryptographic signature proving message integrity
Policy enforcement and spoofing protection
Mail exchanger records confirming receive capability
Understanding SPF, DKIM, and DMARC
These protocols help receivers authenticate email from your domain and handle failures. Published DNS records are only a starting point: inspect real message results, account controls and payment workflows as well.
SPF — Sender Policy Framework
SPF tells receiving mail servers which IP addresses and hostnames are authorised to send email on behalf of your domain. When a message arrives, the receiving server checks whether the sending IP is listed in the SPF record.
- Only one SPF record is allowed per domain — multiple records cause a permanent error.
- SPF allows a maximum of 10 DNS lookups per evaluation. Exceeding this limit results in a permerror, causing SPF to fail for that message.
- End your record with ~all (soft fail) during tuning, then -all (hard fail) for enforcement.
- Use subdomains for high-volume or marketing senders to isolate risk.
v=spf1 include:_spf.google.com ~all
DKIM — DomainKeys Identified Mail
DKIM adds a digital signature to outgoing messages. The sending server signs each email using a private key; the public key is published in DNS under a selector subdomain. Receiving servers verify the signature to confirm the message was not tampered with in transit.
- The selector name (e.g. 'google', 'selector1') must match what your mail platform uses.
- 2048-bit keys are the current minimum recommendation; 1024-bit keys should be rotated.
- Maintain a rollover selector so you can rotate keys without delivery interruption.
- DKIM survives forwarding better than SPF — it is critical for DMARC alignment.
DMARC — Domain-based Message Authentication
DMARC builds on SPF and DKIM by specifying what to do when authentication fails. It also enables aggregate reporting so you can see who is sending email using your domain. DMARC alignment requires the From domain to match the SPF or DKIM authenticated domain.
- p=none: monitor mode — messages that fail authentication are still delivered. Use this only as an initial observation stage.
- p=quarantine: failing messages go to spam. Good intermediate enforcement stage.
- p=reject: asks receivers to reject messages that fail aligned authentication; receiver behavior can vary.
- Add rua= to receive aggregate reports. Without a reporting address, you have no visibility into who is sending email using your domain.
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com
Common failure patterns and fixes
Most email authentication failures fall into a small set of repeating patterns. Use this reference to diagnose and resolve issues quickly.
When to re-run this check
Email authentication can break silently. Any change to DNS, mail routing, or sending providers should trigger a re-check. Use this as your trigger list.
Frequently asked questions
Go deeper on email security
Email Security Tester Guide
Step-by-step workflow for validating SPF, DKIM, and DMARC and turning results into enforceable controls.
Business Email Security Guide
Operational framework for reducing phishing, BEC, and misconfiguration risk in business email environments.
Spot the Fake: BEC Verification
Finance-grade verification controls for stopping payment fraud and impersonation requests.