Email Security Checker
Can criminals send email pretending to be your company? Enter your domain to check SPF, DKIM and DMARC in seconds, with a grade and copy-paste fixes.
The check runs in your browser against public DNS. Nothing is stored on our server.
Email Security Report
Email security: common questions
Why does email security matter for a small business?
Fake invoices and “CEO asks for an urgent transfer” emails are some of the most expensive scams in India. If your domain has no DMARC, a criminal can send email from your exact address to your customers and staff. SPF, DKIM and DMARC let receiving servers spot and block those fakes. They also help your real email land in the inbox instead of spam.
What is a good DMARC policy?
Start with p=none and a reporting address so you can see every service sending as you. When the reports show all your real email passing, move to p=quarantine and then p=reject. Only quarantine and reject actually stop spoofed email.
Why does it say DKIM not found when I have it?
DKIM keys live under a selector name that your provider chooses. We try common ones such as google, selector1 and default. If yours is different, find the s= value in an email’s DKIM-Signature header and enter it in the optional field.
Where do I add these records?
In the DNS settings wherever your domain is managed, for example Hostinger hPanel, GoDaddy, Cloudflare or your registrar. Each record is a TXT record. Changes usually show within an hour but can take up to 48 hours.
Related free tools: DPDP readiness check · Scam message checker · Website safety check