Email Security Check
Check whether your domain's SPF, DKIM and DMARC are set up correctly. You see whether someone can send forged emails in your name, and you get every missing record ready to copy.
- Live from DNS. The records are read directly from your domain's DNS servers.
- Current standards. SPF, DKIM, DMARC and MTA-STS are checked against the current RFCs.
- Line ready to copy. Every suggested record comes with a name and value, exactly as you enter it with your domain provider.
Which domain should we check?
- Free, no sign-up
- Domain is not stored
- Result in a few seconds
Reading the result
The check ends with one of four results. It depends on SPF and DMARC, the two basic records against forgery.
Protected
SPF and DMARC are set up correctly. Forged emails in your name are rejected or end up in spam.
Partly protected
The records exist but are weak, for example when DMARC only monitors (p=none). Forged emails can still be delivered.
Not protected
SPF or DMARC is missing or invalid. Forged emails can be sent in your name, and your own emails end up in spam more easily.
Cannot be checked
The domain's DNS servers did not respond. In that case, we do not give a verdict. Try again a little later.
Reading the records
Every part of a record gives the receiving server a rule. Here we take three sample records apart piece by piece.
SPFAllowed senders
Who may send emails in your name?
example.comTXT
v=spf1 include:_spf.google.com ~all
- 1Marks the line as an SPF record.
- 2Google Workspace servers may send in your name. For every other service that sends in your name, another include is added.
- 3Emails from servers that are not on the list are treated as suspicious. With -all, they are rejected.
DKIMDigital signature
Are your emails digitally signed?
google._domainkey.example.comTXT
v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0B…
- 1Marks the line as a DKIM key.
- 2The type of key, here RSA.
- 3The public key. The recipient uses it to check the email's signature.
The google at the start of the name is the selector. In the email's signature, it appears as s=google.
DMARCAnti-spoofing policy
What happens to forged emails?
_dmarc.example.comTXT
v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com
- 1Marks the line as a DMARC record.
- 2Emails that fail SPF and DKIM end up in spam. With none, they are only monitored; with reject, they are rejected.
- 3Recipients send their reports to this address. That way, you see who sends emails in your name.
How the receiving server checks your email
Behind each of the five steps is a DNS record of your domain. The check reads these records just as the receiving server reads them.
Find the address
From the recipient's MX record, the sending server learns which server the email goes to.
Record
- MX
Encrypt the connection
MTA-STS makes an encrypted connection between the servers mandatory. TLS-RPT sends you a report when encrypted delivery fails.
Records
- MTA-STS
- TLS-RPT
Check the sender
Using your SPF record, the recipient checks whether the sending server may send emails in your domain's name.
Record
- SPF
Check the signature
The email's digital signature is checked with your DKIM key in the DNS. That way, it is noticed if an email was altered in transit.
Record
- DKIM
Decide
Your DMARC record determines what happens to an email that fails the check: deliver it, move it to spam or reject it.
Record
- DMARC
Mail providers' rules
Gmail, Yahoo and Outlook have made SPF, DKIM and DMARC mandatory step by step. Emails that do not meet the rules can end up in spam or not be delivered at all.
Gmail and Yahoo rules
Anyone sending to Gmail or Yahoo addresses needs SPF or DKIM. Anyone sending more than 5,000 emails a day needs all three: SPF, DKIM and DMARC.
Outlook rules
Anyone sending more than 5,000 emails a day to Outlook.com, Hotmail and Live needs SPF, DKIM and DMARC. Anything that does not meet the rules first goes to the junk folder and is rejected if the problem persists.
Gmail rejects emails
Gmail is gradually rejecting emails that do not meet the rules: temporarily at first, then permanently.
Source: sender guidelines from Google, Yahoo and Microsoft.
Frequently asked questions about email security
Here you can read what we check, how to close gaps and what happens to your domain.
Related services
From result to finished solution
Our free tools show you where you stand. If you like, we take care of the rest: setup, integration and ongoing support. The initial consultation is free and without obligation.
- Free initial consultation
- No obligation
- NDA on request