Free email security check
See in seconds whether someone could send email that looks like it came from your company.
Why this matters
Most invoice and wire fraud starts with an email that looks like it came from a real vendor or from your own company. SPF, DKIM and DMARC are the DNS records that let receiving mail servers spot and block those forgeries. Many domains have them missing, broken or left in monitor mode, where forged mail is still delivered.
Read more about email security for Northern Virginia businesses or our guide on DMARC and DKIM.
Common questions
What does this email security check look at?
It reads your domain's public DNS records: the mail servers (MX), SPF, DMARC, common DKIM keys and MTA-STS. Together these decide whether other mail servers can tell real email from your domain apart from forged email. The check is passive and never contacts your mail servers.
What are SPF, DKIM and DMARC?
They are DNS records that prove email claiming to come from your domain really did. SPF lists the servers allowed to send for you, DKIM adds a signature to each message, and DMARC tells receiving servers what to do when a message fails: nothing, quarantine or reject. Set up properly, they make spoofing your domain much harder.
Why does DMARC matter for a small business?
Without an enforced DMARC policy, anyone can send email that appears to come from your domain, which is how most invoice and wire fraud starts. DMARC at p=reject tells receiving servers to block those messages, and its reports show you every service sending as you.
Is this check free, and do you store my domain?
Yes, it is free and you do not need to sign up. The domain you enter is used only to run the lookup; results are cached for up to an hour to keep the tool fast, and nothing is stored with your name. If you ask for a fix plan, we only receive the details you choose to send.
What if DKIM shows as not found?
DKIM keys live under names called selectors, which are not public. The tool checks the common ones used by Microsoft 365, Google Workspace and other providers. If you use a different selector, your DKIM may still be set up correctly; an engineer can confirm it.