Can someone send email that looks like it came from you?
Enter your domain to check the three public records that stop email impersonation. You get a score out of 100 and the steps to fix each gap, in plain English.
Grade –
Send this result to our team.
- A one-page summary with the exact records to publish
- A 15-minute call with an engineer, if you would like one
- A reply within one business day, with no obligation
Thank you. Your result is with our team.
We will send your one-page summary within one business day. If it is urgent, email [email protected].
Three records. One hundred points.
Email was not designed to prove who sent a message. These three records add that proof. When all three are in place and enforced, a message that fakes your address is rejected before anyone sees it.
DMARC 45 points
Tells receiving mail servers what to do with a message that fakes your address: deliver it, send it to spam or reject it. Full marks for a reject policy that covers all mail.
SPF 30 points
Lists the servers that are allowed to send email for your domain. Full marks for a single record that ends in -all.
DKIM 25 points
Adds a digital signature to each message so the recipient can confirm it came from you and was not altered. Full marks when a signing key is published.
What the check does, and what it does not.
What does the check look at?
Only the public DNS records for the domain you enter: SPF, DKIM, DMARC and MX. These are the same records every mail server reads when it receives a message from you. We do not access your email, your accounts or your systems.
Do you keep the domains I check?
No. The check runs when you press the button and the result is shown to you. We do not save the domain or the result. If you ask for the one-page summary, we use the details you send only to reply to you.
Why does DKIM say "not confirmed"?
DKIM keys are published under a name chosen by your email provider, and a public check can only try the common ones. If your provider uses a custom name, signing may be on even though we could not see it. Your provider can confirm.
Is a high score enough?
It means your domain is hard to impersonate by email, which removes one of the most common routes into payment fraud. It says nothing about sign-in security, devices or backups. Those are covered by a Secure Workplace Assessment.
Email is one of five areas we score.
A Secure Workplace Assessment also covers sign-in security, devices, your Microsoft 365 or Google Workspace settings and recovery, and ends with a 90-day plan. Read-only access. Fixed fee.