Email Security Checker
Check SPF and DMARC records to see if your domain is protected against email spoofing.
Sign in to run this scan
Free to use — we just ask you to sign in so scans stay fair for everyone.
How it works
SPF and DMARC are DNS records that tell receiving mail servers which servers are allowed to send email for your domain, and what to do if a message fails that check. Without them, anyone can forge an email that appears to come from your address.
This is checked in seconds by looking up your domain's DNS TXT records — no login or mail server access needed.
Related reading
Frequently asked questions
I have SPF set up — do I still need DMARC?
Yes — SPF alone doesn't tell receiving servers what to do when a check fails, and it can be bypassed in certain spoofing techniques. DMARC ties SPF and DKIM together and defines an enforcement policy, which is what actually stops spoofed mail from reaching inboxes.
Will adding these records break my existing email?
Adding SPF/DMARC itself won't break anything if configured correctly, but start DMARC with a 'p=none' monitoring-only policy to see what would be affected before moving to full enforcement.
Does this tool send a test email to verify delivery?
No — it only reads your domain's public DNS TXT records, so it checks configuration, not actual deliverability outcomes. For that, a seed-list deliverability test is a separate, different kind of check.
Related tools
Email Breach Checker
Check if your email was exposed in known data breaches.
Password Security Checker
Test password strength and check if it's appeared in a known breach — both 100% client-side/private.
JWT Decoder & Analyzer
Decode JWTs and flag alg:none, missing expiry & other issues — 100% client-side.
Technology Detector
Detect CMS, Framework, CDN, Server & Analytics