Can someone send email as your company?
Fake invoices and "urgent payment" emails work best when they come from your real domain. This checks the DNS records that tell inboxes which email really comes from you, grades them A to F, and gives you the exact records to publish.
SPF
Lists the servers allowed to send your email. One record, at most 10 DNS lookups, ending in -all.
DKIM
Signs each email so receivers can prove it wasn't forged or changed. Your provider turns it on and gives you the record.
DMARC
Tells inboxes to reject email that fails both, and sends you reports. p=reject is the goal; p=none only watches.
What this can and can't tell you
It reads public DNS records, the same ones every mail server reads. It finds and helps fix the common gaps attackers look for; it can't stop every phishing email, and it can't see DKIM selectors outside the common ones. The domain you check and the results aren't stored or logged.
How it works
Enter your domain and the check looks up the public DNS records that receiving mail servers read. SPF lists the servers allowed to send for you, DKIM publishes the key that signs your messages, and DMARC says what to do with mail that fails both and where to send reports. It also looks for MTA-STS and TLS-RPT, which protect mail on its way to you, and BIMI. Each record is checked for the mistakes that make it useless, and the result is a grade from A to F with the fixes ranked.
Reading your result
- Grade A or B
- SPF, DKIM and DMARC are in place and DMARC tells inboxes to quarantine or reject forgeries. Keep reading the DMARC reports so a new sending service doesn't get blocked.
- DMARC missing or p=none
- Anyone can send mail that appears to come from your domain and most inboxes will deliver it. Publish DMARC, watch the reports, then move to quarantine and reject.
- SPF warnings
- Usually more than one SPF record, more than 10 DNS lookups, or an ending that allows everyone. Receivers treat a broken SPF record as if there were none.
- DKIM not found
- The check tries the common selector names. If your provider uses its own, DKIM may still be working; look for a DKIM pass in the headers of a message you sent.
Questions
What is the difference between SPF, DKIM and DMARC?
SPF says which servers may send mail for your domain. DKIM signs each message so a receiver can tell it wasn't forged or altered. DMARC ties the two to the address people see and tells inboxes what to do when both fail.
Is it safe to set DMARC to p=reject straight away?
Not usually. Start with p=none and read the reports for a few weeks to find every service that sends mail as you, such as newsletters, invoicing and help desk tools. Fix their SPF and DKIM, then move to quarantine and to reject.
Does this check stop phishing?
It closes one common route: forged mail from your exact domain. It can't stop look-alike domains or a hacked mailbox. Check the first with the lookalike domain finder.