De Faveri Consulting
Free tool

Can criminals send email as you?

Check any domain's SPF, DKIM, and DMARC in ten seconds. Plain-English results and the exact records to fix. Runs entirely in your browser: nothing leaves it except the DNS lookups themselves.

We query public DNS over HTTPS (Cloudflare, then Google). No signup, no scan of your site, no record of your check unless you ask us for the fix list below.

Why this matters

Three records decide who can be you.

Business email compromise starts with a domain nobody protected. These three DNS records are the whole defense, they're free, and in our security reviews they're absent or unenforced on a remarkable share of companies, including funded ones.

SPF

The guest list. Names the servers allowed to send email as your domain, so receivers can tell your mail server from a criminal's.

DKIM

The signature. A cryptographic stamp on every message proving it wasn't altered and really left your systems, even when forwarded.

DMARC

The enforcer. Tells receiving servers what to do when a message fails the other two checks: nothing, spam folder, or reject. Without it, the first two are advisory.

Honest limits: DKIM keys live under provider-specific selector names, so we test the common ones and can miss a custom setup. And these checks read your public DNS, not your mail flow: a perfect score here means spoofing is blocked, not that your email is immune to every attack.