DMARC, SPF and DKIM checker
Can your domain be used to send fake email in your name? Check your SPF, DKIM, DMARC and MTA-STS records for free, with plain-language fixes.
Passive scan: we only read public information (DNS, home page, certificate). No port scanning, no intrusion attempts. Active testing requires written authorization (Criminal Code, s. 342.1).
What the tool checks
SPF lists the servers allowed to send for your domain. The tool flags a missing, duplicate, overly permissive (+all, ?all) or overly complex SPF (more than 10 DNS lookups).
DKIM signs each message. The tool looks for your public keys among the most common selectors (Microsoft 365, Google Workspace, newsletter platforms).
DMARC tells recipients what to do with messages that fail and sends you reports. It is the control that actually stops spoofing, as long as it is set to quarantine or reject.
MTA-STS and TLS-RPT, optional, enforce and monitor encryption of inbound email.
Reading your results
Fix anything marked Critical or High first: that is what lets a fraudster send fake invoices to your customers from your exact address. To publish fixes, use our SPF and DMARC generators, or read our guide SPF, DKIM and DMARC explained.
Frequently asked questions
How do I check my DMARC record?+
Enter your domain above: the tool reads the TXT record published at _dmarc.your-domain, plus your SPF and DKIM keys, then explains each issue found.
Why is no DKIM key found?+
A DKIM key is published under a “selector” chosen by your provider. The tool tests the most common selectors. If yours is custom, DKIM may still work: check in your provider’s console that signing is enabled.
p=none, quarantine or reject: which one?+
Start with p=none and reports (rua) to find all your legitimate senders, then move to quarantine, and finally reject once everything is authenticated. Only quarantine and reject actually protect against spoofing.
Does the check send any email?+
No. It only reads public DNS records. No email is sent and nothing is changed.