Free tool · Email security check
Can scammers send email that looks like it came from you?
Fake emails that use a real business name are now written by AI and look perfect. Three settings on your domain decide whether those fakes get blocked or land in your customers’ inboxes. Enter your website or email address to check yours in a few seconds.
Free, instant, and private. The check reads public records only. Nothing is stored and we do not see what you type.
What We Check, in Plain English
Your domain publishes a few short notes that tell every email system in the world how to treat mail that claims to be from you.
SPF: who may send
A list of the services allowed to send email for your domain, such as Google, Microsoft or your website. Mail from anywhere else is suspect.
DKIM: a tamper seal
A digital signature added to every real message. If a message is not signed, or the signature does not match, it did not come from you.
DMARC: what to do with fakes
The instruction that matters most. It tells inboxes to block or quarantine mail that fails the first two checks. Without it, fakes usually get delivered.
Why This Matters Now
Scammers send emails that look like they came from a real business, asking customers to pay an invoice, update a card or “upgrade” their software. The more convincing the email, the more it costs when it works.
Your customers trust your name
A fake invoice from your domain is far more believable than one from a stranger. Protecting your domain protects them.
Your real email gets delivered
Google, Yahoo and Microsoft now expect these records. Domains without them are more likely to land in spam, even for real messages.
It is a one-time fix
Setting these up correctly takes an expert about an hour, and then it quietly works in the background for years.
Questions
Does this tell me if my email account was hacked?
No. It checks whether other people can pretend to be your domain. If you think an account was broken into, change its password and turn on two-step sign-in right away.
Is it safe to check any domain?
Yes. These records are public by design, the same way your website is. The check runs in your browser and nothing is saved.
Why does DKIM say “not found” when we use Google or Microsoft?
DKIM keys are stored under a name your email provider chooses. We look for the common ones. If yours uses a custom name it may still be set up, and your provider can confirm it. Many providers also leave DKIM switched off until someone turns it on.
Can I fix this myself?
If you are comfortable editing DNS records, yes, but go carefully. A wrong SPF or DMARC record can stop your own email from being delivered. The safe order is SPF and DKIM first, then DMARC set to monitor, then to quarantine or reject once reports look clean.
We do not send email from this domain. Does it matter?
Yes. Unused domains are a favorite for scammers because nobody is watching them. A domain that sends no email should say so with an SPF record that allows nothing and a DMARC policy of reject.
More on spotting fake “upgrade now” emails in our guide to switching web companies safely.
Want Us to Set It Up for You?
We set up and watch these records for the businesses whose websites we manage, along with updates, backups and security. If your check came back yellow or red, we are happy to look at it with you.
