Email security check
Check your domain's email security
See whether criminals could send email pretending to be you. We check SPF, DKIM and DMARC, plus encrypted delivery and BIMI, rate each area out of 5 and explain what we find in plain English.
What we check
Three public records decide whether other email servers can tell your real email from a fake. Together they stop criminals sending invoices and payment requests that look like they came from you. We also check the extras: encrypted delivery (MTA-STS and TLS-RPT), your logo in inboxes (BIMI) and DNSSEC.
SPF: who can send
A list of the services allowed to send email as your domain, such as Microsoft 365 or your newsletter tool.
DKIM: proof it's genuine
A digital signature on each email, so receiving servers can check it really came from you and wasn't changed. DKIM records can't be listed publicly, so we look under the names common providers use, and you can enter your own.
DMARC: what to do with fakes
Tells receiving servers to junk or reject email that fails those checks, and sends you reports on who is using your name.
Next step
Want a second pair of eyes?
Send us your results, or just your domain. We'll explain what we'd change, in what order, without disrupting your genuine email.
Email or a short message form, whichever suits you.