Email security check
Enter a domain to see how well it is protected against email spoofing and certificate misuse. The check reads public DNS records only and gives you a grade with concrete fixes.
The lookups run in your browser through Cloudflare’s public DNS resolver (1.1.1.1). We do not receive or store the domain you enter.
What the check looks at
SPF lists the servers allowed to send mail for the domain. DKIM lets receivers verify a cryptographic signature on each message. DMARC ties the two to the address people see in the From line and tells receivers what to do with mail that fails: deliver it, send it to spam, or reject it.
The check also looks at DNSSEC, which signs the domain’s DNS answers, CAA, which limits who may issue certificates for it, and MTA-STS and TLS reporting, which protect mail in transit.
How to read the grade
Each record earns points; the grade is the share of points reached. A domain without DMARC, or with SPF that allows any server, cannot score well, because anyone can send mail that appears to come from it. DKIM is looked up under common selector names only, so a key under an unusual selector may be reported as missing.
Questions
Does the check touch my servers?
No. It reads public DNS records only, the same ones every mail server in the world reads when it receives your email.
Our domain does not send email. Do we need these records?
Yes. Attackers like domains that send no mail, because nobody notices forged messages. Publish SPF with -all and DMARC with p=reject to block them.
Is a high grade enough?
It shows that the DNS side of email security is in order. It says nothing about your mail servers, accounts or users. A penetration test covers those.
Need more than a tool can show?
A tool checks one thing. Our consultants look at the whole picture.
Managed securityRelated articles
-
How to spot a phishing link before you click
Learn to read a URL like an attacker builds it - registrable domains, lookalike and punycode domains, the @ trick, open redirects, shorteners and new TLDs.
-
SPF, DKIM and DMARC explained - a safe path to p=reject
How SPF, DKIM and DMARC stop others sending email as your domain, how to move from p=none to p=reject safely, and the mistakes that break mail.