Omega IT
    FREE TOOL · NO SIGN-UP

    Email Security Checker

    Check whether a domain is protected against email spoofing. We read its public SPF, DKIM and DMARC records and explain what each result means.

    Uses public DNS records only. We don't send any email or store the domain you enter.

    What the checker looks at

    SPF is a TXT record on your domain listing the services allowed to send as you, such as Microsoft 365 or your newsletter platform. It should end in -all or ~all, and stay within SPF's limit of ten DNS lookups.

    DKIM signs each outgoing message with a key whose public half sits in DNS under a selector. Receivers use it to confirm the message really came from your platform and wasn't changed on the way.

    DMARC, published at _dmarc on your domain, ties the two together: it tells receivers whether to deliver, quarantine or reject mail that fails, and where to send reports.

    MX and MTA-STS show where your mail is delivered and whether other servers must use encryption to deliver it.

    Email security checker FAQs

    What do SPF, DKIM and DMARC do?

    SPF lists the servers allowed to send email for your domain. DKIM adds a cryptographic signature to each message so receivers can check it wasn't altered and really came from you. DMARC tells receivers what to do with mail that fails those checks, and sends you reports about who is sending as your domain.

    Why does this matter for a small business?

    Without them, anyone can send email that appears to come from your domain, which is how many invoice-fraud and impersonation scams work. Mailbox providers also use these records to decide whether your own mail reaches the inbox; Google, Yahoo and Microsoft now expect bulk senders to publish all three.

    Why does the checker say DKIM wasn't found when we use it?

    DKIM keys are published under a selector name that only appears in the signed messages themselves. We check the selectors used by Microsoft 365, Google Workspace and other common platforms. If yours uses a custom selector, look for s= in the DKIM-Signature header of an email you've sent.

    Is p=none good enough for DMARC?

    It's the right place to start, because you receive reports without affecting delivery. But p=none doesn't stop spoofed mail. Once the reports show your legitimate senders pass, move to p=quarantine and then p=reject.

    Our domain doesn't send email. Do we still need these records?

    Yes. Unused domains are attractive to spoofers because nobody watches them. Publish an SPF record of v=spf1 -all and a DMARC record with p=reject to tell receivers to refuse any mail claiming to be from it.

    Do you store the domains I check?

    No. The checker reads public DNS records and doesn't save the domain you enter. Normal website traffic logging still applies.

    Related service: Cyber security

    More free tools