Free tool
Free email security check.
See how your domain's SPF, DKIM, DMARC, MTA-STS and related records look to the rest of the internet, with plain-English fixes.
Check a domain
Six checks, in plain English.
- MX
- Which mail servers receive your email, and which provider runs them.
- SPF
- One record listing who may send as you, ending in ~all or -all, with no more than 10 DNS lookups.
- DMARC
- Your policy for mail that fails SPF and DKIM, and where reports go.
- DKIM
- Signing keys on the most common selectors.
- MTA-STS and TLS reporting
- Whether senders must use encryption when delivering to you, and whether you hear about failures.
- BIMI
- Optional logo display in supporting inboxes.
New to these terms? See SPF, DKIM and DMARC in the glossary.
What is SPF?
- What it is
- A TXT record at your domain listing the servers and services allowed to send mail as you (RFC 7208).
- What good looks like
- Exactly one record starting v=spf1, every real sender included, at most 10 DNS lookups, ending in ~all or -all.
- Common mistake
- Publishing two SPF records, or adding include: after include: until the record passes 10 lookups and fails with a permerror.
What is DKIM?
- What it is
- A cryptographic signature added to each message, checked against a public key published at selector._domainkey.yourdomain.
- What good looks like
- DKIM turned on in every platform that sends as you (Microsoft 365, Google Workspace, Zoho, your newsletter tool), with 2048-bit keys where supported.
- Common mistake
- Assuming DKIM is on because the mail platform is set up. Google Workspace and Microsoft 365 custom domains need it switched on.
What is DMARC?
- What it is
- A TXT record at _dmarc.yourdomain telling receivers what to do with mail that fails SPF and DKIM alignment, and where to send reports (RFC 9989).
- What good looks like
- One record with p=reject (or quarantine on the way there), no pct below 100, an rua address for aggregate reports, and sp not set to none.
- Common mistake
- Leaving p=none in place for years. It monitors but does not stop anyone spoofing your domain.
What is MTA-STS?
- What it is
- A DNS record plus a policy file at https://mta-sts.yourdomain that tells senders to deliver only over verified TLS (RFC 8461).
- What good looks like
- One _mta-sts TXT record with a current id, a reachable policy file listing every MX host, and mode: enforce after a testing period.
- Common mistake
- Changing MX records without updating the policy file, which makes compliant senders refuse to deliver.
What is TLS-RPT?
- What it is
- A TXT record at _smtp._tls.yourdomain giving an address for daily reports of TLS delivery failures (RFC 8460).
- What good looks like
- One record, v=TLSRPTv1, with a rua mailbox or service someone actually reads.
- Common mistake
- Publishing MTA-STS without TLS reporting, so you never learn that mail is failing to arrive.
What is BIMI?
- What it is
- A TXT record at default._bimi.yourdomain pointing to your logo, shown beside your messages in supporting inboxes.
- What good looks like
- DMARC at quarantine or reject, an SVG Tiny PS logo and, for Gmail and Apple Mail, a VMC or CMC mark certificate.
- Common mistake
- Adding BIMI before DMARC is enforced. Inboxes ignore it until the policy is quarantine or reject.
DMARC needs alignment: the domain that passes SPF (the envelope sender) or signs with DKIM must match the domain in the visible From address. Many third-party tools pass SPF with their own domain, so DMARC still fails until you set up DKIM signing with your domain or a custom return-path.
No. p=none only collects reports; receivers still deliver spoofed mail. It is the right starting point, but the aim is quarantine and then reject once every legitimate sender passes. Gmail and Yahoo require at least p=none from bulk senders; protection needs enforcement.
Ten. Each include, a, mx, ptr, exists and redirect counts, including those nested inside includes. Past ten, SPF returns a permanent error and receivers treat it as a fail. Remove unused senders or move some to a subdomain.
No, it is optional. It can make your messages more recognisable, but it needs DMARC enforcement and usually a paid mark certificate. Get SPF, DKIM, DMARC, MTA-STS and TLS reporting right first.
Yes. It is free and needs no sign-up. The check runs in your browser: your browser sends DNS lookups for the domain to Cloudflare's public resolver (Google Public DNS as fallback). We never receive or store the domain or the results.
Go further.
- Guide
DMARC from p=none to p=reject
Move to enforcement without breaking legitimate email.
Read the guide - Service
Email security and deliverability
SPF, DKIM, DMARC and MTA-STS set up and monitored for you.
Learn moreExplore the service - Tool
DPDP readiness self-check
Twelve questions on India's data protection law.
Start the self-check
Let's build what's next.
Tell us about your infrastructure, security or automation goals. We reply with questions, then a written plan with scope and next steps.
- Response
- Usually within one business day
- Location
- Worldwide
What happens next
- 01
Reply
- 02
Discovery call
- 03
Proposal