Email Security Checker
Can someone send email as your domain?
Check SPF, DKIM, DMARC and MTA-STS to see if your domain can be spoofed and whether your email will reach the inbox
Enter a domain to check
Advanced: I know my DKIM selector
DKIM selectors have no public list, so we try about 35 common ones. If yours is custom, find it in the DKIM-Signature header of a sent email (the s= value).
We only read public DNS records and the public MTA-STS policy file. No email is sent and no mail server is contacted.
Looking up DNS records…
Overview
Secure email is one part of a healthy site
Run a complete audit to check performance, mobile-friendliness, meta tags, and more.
Run Free Website AuditAbout Email Security Checker
Email was designed without a way to prove who sent a message, which is why anyone can forge the “From” address of your domain. Four DNS-based standards close that gap. SPF lists the servers allowed to send for your domain. DKIM adds a cryptographic signature that receivers verify with a public key you publish. DMARC ties the two together, tells receivers what to do with mail that fails, and sends you reports. MTA-STS protects mail on its way to you by requiring encrypted delivery. This tool reads all of them, follows SPF includes to count the DNS lookups receivers will make, inspects DKIM key strength, checks that DMARC reporting addresses are authorised, and downloads your MTA-STS policy to confirm it matches your real mail servers. Each result comes with plain-language fixes and, when a record is missing, a starting record you can copy.
Why does SPF fail with more than 10 lookups?
SPF limits the DNS lookups a receiver performs to 10 to prevent abuse. Every include, a, mx, exists, ptr and redirect counts, including those inside the records you include. Go over, and receivers treat SPF as a permanent error, so legitimate mail can fail. Remove services you no longer use.
Why can’t the tool find my DKIM record?
DKIM records live at a name that includes a selector chosen by your email provider, and DNS cannot list them. We try about 35 common selectors. If yours is different, enter it under Advanced, or look at the DKIM-Signature header of an email you sent.
What DMARC policy should I use?
Start with p=none and a rua address to collect reports, fix any legitimate senders that fail, then move to quarantine and finally reject. Only quarantine and reject actually stop spoofed mail.
Do I need MTA-STS?
It is optional but valuable. Without it, an attacker on the network can strip encryption from mail sent to you. It needs a DNS record and a small policy file served over HTTPS at mta-sts.yourdomain. Start in testing mode, watch TLS-RPT reports, then switch to enforce.
My domain doesn’t send email. What should I publish?
Publish SPF v=spf1 -all, a DMARC record with p=reject, and a null MX. That stops criminals using it for phishing, and this tool will treat the setup as complete.