Email Security Check for Your Domain
Run a free email security check and see how hard it is for someone to send email that looks like it came from you. We grade your SPF, DKIM and DMARC, and explain each one in plain words.
02 · Email header analyser
Check a single email with the header analyser
Pasted a header from a message you are not sure about? The email header analyser reads it for you.
Every email carries a header with the technical details of how it travelled. The header analyser pulls out the SPF, DKIM and DMARC results for that one message and shows them in plain words.
It is a fast way to judge a message that claims to be from a bank, a supplier or a staff member. You see whether the checks passed, which server sent it, and where it really came from.
SPF, DKIM and DMARC in plain words
Three records do the heavy lifting for email security. Here is what each one is for, and what our check reads.
SPF
SPF stands for Sender Policy Framework. It is a public list of the servers allowed to send email for your domain. When a message arrives, the receiving server checks this list, and a message from a server that is not on it can be marked as suspicious. We read your SPF record and flag common problems, like too many lookups or a record that allows any server to send.
DKIM
DKIM stands for DomainKeys Identified Mail. It adds a signature to each message, created with a private key only you hold. The receiving server uses a matching public key in your DNS to confirm the message really came from you and was not changed on the way. We check that a DKIM record is published and readable so signed mail can be verified.
DMARC
DMARC ties SPF and DKIM together. It tells receiving servers what to do when a message fails those checks, such as send it to spam or reject it, and it can ask for reports so you can see who is sending as you. Our DMARC checker reads your policy and tells you whether it is set to monitor only or to actively block fakes.
On this page
What the grade measures
SPF, DKIM and DMARC explained
The email header analyser
Saved domains and grade history
Common domain questions
Common domain questions
Frequently Asked Questions
- Do I need an account to run an email security check?
- No. You can run the check on a domain without an account and read the grade straightaway. An account is only needed if you want to save domains, keep a grade history, export a CSV or add a badge.
- Do I need all three of SPF, DKIM and DMARC?
- Yes, each one covers a different gap. SPF lists who may send for you, DKIM proves a message was not changed, and DMARC decides what happens when a message fails. A domain with all three set correctly is much harder to spoof than one with only one or two.
- Is there a DMARC checker on this page?
- Yes. The grade reads your DMARC policy and tells you whether it is set to monitor only or to block messages that fail. The header analyser also shows the DMARC result for a single email you paste in.
- Will the check send email from my domain or change anything?
- No. The email security check reads your public DNS records only. It does not send mail, change your records, or need access to your mailbox.
- What does the email header analyser tell me?
- It reads the header from one message and shows the SPF, DKIM and DMARC results for that message, the sending server, and where the email really came from. It helps you judge a message, but it cannot confirm a message is safe on its own.
- What should I fix first if my grade is low?
- Start with the record that is missing or broken, then work through the plain-English notes the check gives you. If staff accounts may be caught up in a breach as well, you can also run a breach check on their email addresses.
Grade your domain, then fix what matters first.
No account needed to run the check. Everything on the site is free to use.