Email Security Checker
Check your domain's SPF, DMARC, and MX records. Get a security grade and actionable recommendations.
How Email Authentication Works
SPF Check
Receiving server checks if the sender's IP is authorized in your SPF record
DKIM Check
Email signature is verified against your domain's public key
DMARC Policy
If checks fail, DMARC tells the server to reject, quarantine, or allow
Frequently Asked Questions
What is SPF and why does it matter?
SPF (Sender Policy Framework) is a DNS record that specifies which mail servers are allowed to send email on behalf of your domain. Without SPF, attackers can easily spoof emails from your domain for phishing attacks.
What is DMARC and how does it protect my domain?
DMARC (Domain-based Message Authentication) tells receiving mail servers what to do when SPF or DKIM checks fail. With a 'reject' policy, spoofed emails are blocked. Without DMARC, even failed checks might still deliver the email.
What DMARC policy should I use?
Start with p=none to monitor without affecting delivery. Once you're confident legitimate emails pass authentication, move to p=quarantine (spam folder), then p=reject (block completely). Always set up rua= to receive reports.
My domain doesn't send email - do I still need these records?
Yes! Without SPF and DMARC, attackers can still spoof your domain. Add 'v=spf1 -all' and 'v=DMARC1; p=reject' to block all email from your domain.
How do I add SPF and DMARC records?
Add TXT records in your domain's DNS settings. SPF goes on your root domain, DMARC goes on _dmarc.yourdomain.com. Your DNS provider or hosting dashboard will have a section for managing DNS records.
More Free Tools
View all 9 toolsCheck SSL certificate validity and TLS security
Test password strength (100% client-side)
Check if your email was exposed in breaches
Check DNSSEC and CAA records
Your privacy matters. We don't store any data you submit. Learn more
Check More Than Just Email
VAS scans your entire web application for security vulnerabilities - exposed API keys, database misconfigurations, missing security headers, and more.
Run Full Security Scan