Can criminals send email as you?
Email Security Checker: SPF, DKIM and DMARC
Enter your domain and get an instant A to F grade on SPF, DKIM and DMARC, so you know whether criminals can send email as your business. No signup.
What gets checked
- SPF record and whether it fails unlisted senders
- SPF DNS lookup count (the 10-lookup limit)
- DMARC policy: none, quarantine or reject
- DMARC reporting address (rua)
- DKIM signing on common selectors
- Mail host, MTA-STS and BIMI
Your grade
Enter a domain to see its grade
A to F, in a few seconds, with no signup. The grade shows here; the step-by-step fix guide comes by email.
Why email authentication matters
If your domain has no DMARC policy, or one set to p=none, anyone can send email that appears to come from your business, and most receiving servers will accept it. That is how invoice fraud and business email compromise start: a message that looks like it is from your owner or your accounts team, sent from a server you do not control.
The fix is three DNS records working together. SPF says which servers may send for you, DKIM signs what you send, and DMARC tells the world to reject anything that fails. Google, Microsoft and Yahoo now require all three from bulk senders, so authentication also decides whether your legitimate mail reaches the inbox. The checker above grades the records you already have; the emailed guide walks through the fixes in the order that matters.
Questions
- What does the email security checker test?
- It reads your public DNS records and grades six things: whether SPF exists and ends with a hard fail, whether SPF stays within the 10-lookup limit, whether DMARC exists and is enforced (quarantine or reject) with reporting turned on, whether DKIM signing is published on common selectors, who hosts your mail, and whether MTA-STS and BIMI are in place. Nothing is sent to your mail server.
- What do SPF, DKIM and DMARC do?
- SPF lists the servers allowed to send email for your domain. DKIM adds a cryptographic signature that proves a message was not altered and really came from you. DMARC tells receiving servers what to do when a message fails those checks and sends you reports on who is sending as your domain. Together they stop domain spoofing.
- What is a good email security grade?
- An A means SPF, DKIM and DMARC are all in place and DMARC is set to reject, so forged mail is thrown away. A B usually means DMARC is still at quarantine. C and below means criminals can send email that appears to come from your domain, and your own mail is more likely to land in spam.
- My DMARC policy is p=none. Is that a problem?
- Yes. A p=none policy only reports spoofing; it does nothing to stop it. It is the right first step while you confirm every legitimate sender passes, but businesses often stay there for years. Moving to quarantine and then reject is what protects your name.
- Why does the checker say no DKIM was found when DKIM is on?
- DKIM records live under a selector name chosen by your provider. The checker tests the common ones (Microsoft 365 selector1 and selector2, Google, and a dozen others). If your provider uses a custom selector, DKIM can be on and still not appear here. The emailed guide explains how to confirm it.
- Can bdManagedIT fix a low grade for us?
- Yes. Setting up SPF, DKIM and DMARC correctly, moving to an enforced policy without blocking real mail, and monitoring the reports afterwards is part of our managed email security service. A low grade on this page is usually a one-week fix.