Can scammers send email as your business?
If SPF, DKIM and DMARC aren't set up right, anyone can send invoices and payment requests that look like they came from you, and your real emails end up in spam. Enter your domain or work email to see where you stand, with the exact fix for each gap.
I only read your domain's public DNS records. No email is sent, your mail server isn't contacted, and nothing is stored.
Also free: website security scan
Check your site's security headers, HTTPS setup and outdated scripts in 20 seconds.
Questions
What are SPF, DKIM and DMARC?
Three DNS records that prove an email really came from you. SPF lists the servers allowed to send as your domain, DKIM signs each message, and DMARC tells Gmail, Outlook and Yahoo what to do with mail that fails: allow it, send it to spam or reject it.
Why do my emails go to spam?
Missing or broken SPF, DKIM or DMARC is the most common reason. Since 2024, Gmail and Yahoo require them from anyone sending in volume, and they treat unauthenticated mail with suspicion. Fix those first, then look at content and sending reputation.
Is it safe to run this?
Yes. It only reads public DNS records, the same ones every mail server reads when you send an email. It never contacts your mail server or sends any email.
Why does it say DKIM wasn't found when I have it?
DKIM keys live under a name (a selector) your provider picks, and DNS can't list them. I check the common ones (Google, Microsoft 365, Zoho, Proton, Fastmail and others). If yours uses a custom selector, that line may be a false alarm.
Do you store my domain or results?
No. Results are cached for 15 minutes so a refresh is instant, then discarded. Only if you fill in the form do I get your email and the results.