Free tool
Email security checker
Check SPF, DKIM, DMARC, MX, MTA-STS and TLS-RPT for your domain and find out whether your email can be spoofed or will land in spam.
What you get out of it
- Find out whether someone can send email that looks like it came from you.
- See why your email might be landing in customers' spam folders.
- Get the exact records to publish, ready to forward.
A one-off check is a snapshot. Add the domain to DomainGuard and it is watched: its uptime every five minutes on every plan, and on Starter and up every check here again each day, with an alert in the app when something important changes. What DomainGuard watches
What it checks
- SPF record checkSPF lists the servers allowed to send email as your domain. Without a valid one, your mail lands in spam and forgeries get through.
- SPF lookup limit checkAn SPF record may trigger at most 10 DNS lookups. Past that, receivers treat it as broken and your mail loses its SPF pass.
- SPF policy strength checkThe ending of your SPF record (-all, ~all, ?all or +all) decides what receivers do with mail from servers you did not list.
- DKIM record checkDKIM puts a tamper-proof signature on every email you send. Receivers use it to prove the message really came from you.
- DMARC record checkDMARC tells receivers what to do with email that fails SPF and DKIM, and sends you reports on who is sending as your domain.
- MX record checkMX records tell the internet which servers receive email for your domain. Wrong or missing MX means lost mail.
- MTA-STS checkMTA-STS tells other mail servers they must use encryption when delivering to you, closing off downgrade and interception attacks.
- TLS-RPT checkTLS-RPT asks other mail servers to report when they could not deliver to you securely, so you hear about problems before mail is lost.
- DNS lookup checkBefore we can check anything about your email, your domain's DNS has to answer. This check says when it did not.
Other free checkers
- Website & Domain ReportOne report on your email security, DNS, SSL, security headers, cookies, registration and reputation, with a link you can share with your IT provider.
- SPF CheckerCheck your domain's SPF record: whether it is valid, whether it stays under the 10-lookup limit, and how strictly it treats unlisted senders.
- DMARC CheckerCheck whether your domain has a DMARC record, what its policy is, and whether it protects your customers from email sent in your name.
- DKIM CheckerCheck whether your domain publishes DKIM keys for common mail providers, so receivers can verify your email is really from you.
- SSL CheckerCheck your website's SSL certificate: expiry date, trust chain, hostname coverage, TLS versions, HTTPS redirect and HSTS.
- Security Headers CheckerCheck your website's HTTP security headers (CSP, HSTS, X-Frame-Options and more) and cookie flags, with a fix for each one missing.
- DNS CheckerCheck your domain's nameservers, redundancy, MX records and CAA records, and find the DNS problems that take websites and email offline.
- Blacklist CheckerCheck whether the servers behind your domain are listed on the spam blocklists mail providers use to reject email.
- Domain Expiration CheckerCheck when your domain expires, who it is registered with, how old it is and who hosts the website, so a lapsed renewal never takes your site and email down.