Grade any domain on DMARC, SPF, DKIM, DNSSEC, CAA and more in about twenty seconds. Plain English, no signup, no email. If it comes back clean, we will tell you so.
Runs in your browser against public DNS. No signup and no email needed. We keep a log of the domain and its grade, and nothing that identifies you.
Looking up DNS records…
Six acronyms stand between your business and someone impersonating it. Here is what each one actually does, without the jargon.
The instruction you give receiving mail servers about what to do when a message claiming to be you fails authentication. Without it, they have been told nothing, so they deliver the forgery. At p=none it watches impersonation happen and does nothing. At p=reject the forged mail is refused outright.
The published list of servers allowed to send email for your domain. Two things quietly break it: exceeding the ten-lookup limit, which invalidates the whole record with no warning, and ending in ~all instead of -all, which tells receivers to accept forged mail but flag it. Most deliver it anyway.
A cryptographic signature added to your outgoing mail, proving it really came from a service authorised to send for you. Unlike SPF it survives forwarding. Every service that sends on your behalf needs its own key, and that is the part usually missed after a migration.
What DKIM signing does →Signs your DNS answers so they can be validated rather than taken on trust. Without it, the answer telling the world where your website and mail live can be forged in transit, and your customers would follow it with no warning shown to them.
What DNSSEC is and why it matters →Names the certificate authorities permitted to issue an HTTPS certificate for your domain. With no CAA record, any certificate authority on earth can issue one for you. It is free, takes minutes, and almost nobody has it.
The CAA record, explained →MX says which servers receive your mail, and every one of them has to be accounted for in SPF and DKIM. MTA-STS requires that mail sent to you uses an encrypted connection. We show both for context rather than scoring them.
How we fix all of this →The checks themselves run in your own browser, using DNS-over-HTTPS against public resolvers. Everything the checker reads is public DNS, the same information every mail server on the internet already sees when it decides whether to trust a message from you.
We do keep a log of the result: the domain checked, the grade, and which controls passed or failed. That is how we see which problems are most common and improve the tool. We would rather tell you that plainly than claim otherwise.
What we do not keep: your name, your email address, or your IP address. There is no signup and no email is ever requested. Your IP is briefly hashed for rate limiting and discarded within the hour, so a check cannot be traced back to a person. Full detail is in our privacy policy.
It is free and there is no signup. You do not enter an email address, and we do not ask for one. The checks run in your browser against public DNS.
Yes, and we would rather say so than pretend otherwise. We log the domain checked, the grade it received and which controls passed or failed, so we can see which problems are most common and improve the tool. We do not log your name, your email address or your IP address, so a check cannot be traced back to you. Your IP is briefly hashed to stop abuse and discarded within the hour.
DMARC (whether it exists, whether it is enforced, and whether reports are being collected), SPF (whether it exists, whether it is strict, whether there is more than one record, and whether it exceeds the ten-lookup limit), DNSSEC, CAA, DKIM on common selectors, MX routing, and MTA-STS.
Because DKIM keys live on selector names that are not published anywhere. From outside your domain we can only test well-known selectors, so "not found" is not proof that DKIM is missing. Scoring a guess would be dishonest, so we report DKIM for information and leave it out of the score.
Yes. Every record the checker reads is public DNS, the same information any mail server on the internet already sees. Run it against a domain whose answer you already know, so you can see the tool is right before you trust it on your own.
Each failed check explains what it means in plain English and links to how we fix it. You can also take the result to your own IT provider. If you would rather we handled it, book a scoping call and we will quote a fixed fee.
Probably not for email. If your check comes back clean we say so, and we will not invent work. There are things this tool cannot see from outside, such as where your team keeps its shared passwords, and those are worth a conversation.
Staged changes so your site and email never go dark, then a before-and-after report you can hand to a board or a client, and a checker you can re-run any time.