Free Email Security Checker
Enter any domain to instantly validate its SPF, DKIM, and DMARC records. Get a 0–100 security score, plain-English explanations of every finding, and copy-ready DNS fixes — no account required.
How the security score is calculated
The 0–100 score reflects the presence and quality of your domain's email authentication records. Each protocol contributes a fixed maximum; partial credit is awarded for records that exist but have configuration issues.
Authorises which servers may send for your domain
Cryptographic signature proving message integrity
Policy enforcement and spoofing protection
Mail exchanger records confirming receive capability
Understanding SPF, DKIM, and DMARC
These three DNS-based protocols work together to authenticate email and prevent domain spoofing. Each one addresses a different layer of the problem — you need all three for full protection.
SPF — Sender Policy Framework
SPF tells receiving mail servers which IP addresses and hostnames are authorised to send email on behalf of your domain. When a message arrives, the receiving server checks whether the sending IP is listed in the SPF record.
- Only one SPF record is allowed per domain — multiple records cause a permanent error.
- SPF allows a maximum of 10 DNS lookups per evaluation. Exceeding this limit results in a permerror, causing SPF to fail for that message.
- End your record with ~all (soft fail) during tuning, then -all (hard fail) for enforcement.
- Use subdomains for high-volume or marketing senders to isolate risk.
v=spf1 include:_spf.google.com ~all
DKIM — DomainKeys Identified Mail
DKIM adds a digital signature to outgoing messages. The sending server signs each email using a private key; the public key is published in DNS under a selector subdomain. Receiving servers verify the signature to confirm the message was not tampered with in transit.
- The selector name (e.g. 'google', 'selector1') must match what your mail platform uses.
- 2048-bit keys are the current minimum recommendation; 1024-bit keys should be rotated.
- Maintain a rollover selector so you can rotate keys without delivery interruption.
- DKIM survives forwarding better than SPF — it is critical for DMARC alignment.
DMARC — Domain-based Message Authentication
DMARC builds on SPF and DKIM by specifying what to do when authentication fails. It also enables aggregate reporting so you can see who is sending email using your domain. DMARC alignment requires the From domain to match the SPF or DKIM authenticated domain.
- p=none: monitor mode — messages that fail authentication are still delivered. Use this only as an initial observation stage.
- p=quarantine: failing messages go to spam. Good intermediate enforcement stage.
- p=reject: failing messages are refused. Full protection against domain spoofing.
- Add rua= to receive aggregate reports. Without a reporting address, you have no visibility into who is sending email using your domain.
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com
Common failure patterns and fixes
Most email authentication failures fall into a small set of repeating patterns. Use this reference to diagnose and resolve issues quickly.
When to re-run this check
Email authentication can break silently. Any change to DNS, mail routing, or sending providers should trigger a re-check. Use this as your trigger list.
Frequently asked questions
Go deeper on email security
Email Security Tester Guide
Step-by-step workflow for validating SPF, DKIM, and DMARC and turning results into enforceable controls.
Business Email Security Guide
Operational framework for reducing phishing, BEC, and misconfiguration risk in business email environments.
Spot the Fake: BEC Verification
Finance-grade verification controls for stopping payment fraud and impersonation requests.