Runs in your browser against public DNS. We keep a log of the domain and its grade.
Looking up DNS records…
Six acronyms stand between your business and someone impersonating it.
The instruction you give receiving mail servers about what to do when a message claiming to be you fails authentication. Without it, they have been told nothing, so they deliver the forgery. At p=none it watches impersonation happen and does nothing. At p=reject the forged mail is refused outright.
The published list of servers allowed to send email for your domain. The failure that really bites is exceeding the ten-lookup limit, which silently invalidates the whole record. The ~all versus -all ending matters less than people claim: SPF checks the envelope sender, not the address you see, so it is DMARC that refuses mail displaying your domain. With DMARC enforcing, ~all is fine.
A cryptographic signature added to your outgoing mail, proving it really came from a service authorised to send for you. Unlike SPF it survives forwarding. Every service that sends on your behalf needs its own key, and that is the part usually missed after a migration.
What DKIM signing does →Signs your DNS answers so they can be validated rather than taken on trust. Without it, the answer telling the world where your website and mail live can be forged in transit, and your customers would follow it with no warning shown to them.
What DNSSEC is and why it matters →Names the certificate authorities permitted to issue an HTTPS certificate for your domain. With no CAA record, any certificate authority on earth can issue one for you. It is free, takes minutes, and almost nobody has it.
The CAA record, explained →MX says which servers receive your mail, and every one of them has to be accounted for in SPF and DKIM. MTA-STS requires that mail sent to you uses an encrypted connection. We show both for context rather than scoring them.
How we fix all of this →The checks themselves run in your own browser, using DNS-over-HTTPS against public resolvers. Everything the checker reads is public DNS, the same information every mail server on the internet already sees when it decides whether to trust a message from you.
We do keep a log of the result: the domain checked, the grade, and which controls passed or failed. That is how we see which problems are most common and improve the tool. We would rather tell you that plainly than claim otherwise.
What we do not keep: your name, your email address, or your IP address, in any form. There is no signup and no email is ever requested. Nothing in the log points at a person, so a check cannot be traced back to you. Full detail is in our privacy policy.
It is free and there is no signup. You do not enter an email address, and we do not ask for one. The checks run in your browser against public DNS.
Yes, and we would rather say so than pretend otherwise. We log the domain, its grade and which controls passed or failed. Not your name, not your email address, not your IP.
DMARC (whether it exists, whether it is enforced, and whether reports are being collected), SPF (whether it exists, whether it is strict, whether there is more than one record, and whether it exceeds the ten-lookup limit), DNSSEC, CAA, DKIM on common selectors, MX routing, and MTA-STS.
Because DKIM keys live on selector names that are not published anywhere. From outside your domain we can only test well-known selectors, so "not found" is not proof that DKIM is missing. Scoring a guess would be dishonest, so we report DKIM for information and leave it out of the score.
Yes. Every record the checker reads is public DNS, the same information any mail server on the internet already sees. Run it against a domain whose answer you already know, so you can see the tool is right before you trust it on your own.
Each failed check explains what it means in plain English and links to how we fix it. You can also take the result to your own IT provider. If you would rather we handled it, book a security review and we will quote a fixed fee.
Probably not for email. If your check comes back clean we say so, and we will not invent work. There are things this tool cannot see from outside, such as where your team keeps its shared passwords, and those are worth a conversation.
Staged changes so your site and email never go dark, then a before-and-after report you can hand to a board or a client, and a checker you can re-run any time.