Email Security Checker
Can someone send email pretending to be you? Will Gmail and Outlook accept your mail? Check a domain's SPF, DKIM and DMARC in seconds, and get the exact records to fix anything missing.
- SPF, DKIM, DMARC
- Google, Microsoft and NCSC rules
- Ready-made fixes
What each record does
- SPF lists the servers allowed to send email for your domain.
- DKIM adds a digital signature to your emails, so receivers can check they weren't forged or changed.
- DMARC tells receivers what to do when an email claiming to be from you fails both checks (deliver, send to spam, or reject) and sends you reports.
- MTA-STS and TLS-RPT make other servers use encryption when delivering to you, and report when they can't.
- BIMI shows your logo beside your emails in supporting inboxes.
Why it matters now
- Since February 2024, Gmail and Yahoo reject or junk mail from bulk senders without SPF, DKIM and DMARC, and Microsoft followed in 2025.
- Without DMARC at quarantine or reject, criminals can send invoices and payment requests that look exactly like they come from you.
- The UK's National Cyber Security Centre recommends every organisation reaches DMARC p=reject, including domains that never send email.
Is it safe to go straight to p=reject?
Not usually. Start with p=none and a reporting address, read the reports for a few weeks to find every service that sends as you (website forms, newsletters, invoicing, CRM), make sure each passes SPF or DKIM, then move to quarantine and finally reject.
Why does it say DKIM wasn't found when I have it?
DKIM keys live under a "selector" name that only your email provider knows, and there's no way to list them. We try about 40 common ones. Open an email you sent, view its headers, find "DKIM-Signature" and enter its s= value above.
What is the 10-lookup limit?
SPF may trigger at most 10 DNS lookups, counting every include:, a, mx, exists and redirect, including those inside the records you include. Past 10, receivers treat SPF as broken. Remove services you no longer use, or replace includes with ip4: ranges where a provider allows it.
What about domains we don't send email from?
Lock them down so they can't be used for phishing: an SPF record of "v=spf1 -all", a DMARC record with p=reject, and a null MX record. The checker suggests the exact records.