Free tool
Can criminals send email as you?
Check any domain's SPF, DKIM, and DMARC in ten seconds. Plain-English results and the exact records to fix. Runs entirely in your browser: nothing leaves it except the DNS lookups themselves.
Check your domain
Why this matters
Three records decide who can be you.
Business email compromise starts with a domain nobody protected. These three DNS records are the whole defense, they're free, and in our security reviews they're absent or unenforced on a remarkable share of companies, including funded ones.
SPF
The guest list. Names the servers allowed to send email as your domain, so receivers can tell your mail server from a criminal's.
DKIM
The signature. A cryptographic stamp on every message proving it wasn't altered and really left your systems, even when forwarded.
DMARC
The enforcer. Tells receiving servers what to do when a message fails the other two checks: nothing, spam folder, or reject. Without it, the first two are advisory.
Honest limits: DKIM keys live under provider-specific selector names, so we test the common ones and can miss a custom setup. And these checks read your public DNS, not your mail flow: a perfect score here means spoofing is blocked, not that your email is immune to every attack.
Email is the public part. We audit the rest.
Your code, cloud configuration and authentication are where the findings that sink enterprise deals live. Our fixed-fee security audit covers them in two weeks, every finding signed by a senior engineer.