Is your domain protected with SPF, DKIM and DMARC? Find out in seconds, with a grade and the exact records to fix it. It stops people sending email pretending to be you, and helps keep your own email out of spam.
Got an email with a link you’re not sure about? Try our free Phishing Checker before you click.
Got an email or text with a link you’re not sure about? Paste the link, or the whole email, here. We check it from our server, so nothing opens on your computer: known scam and malware lists, how new the site is, where shortened links really go, look-alike names like paypa1-secure.com, and links whose text shows one site but go to another.
Without DMARC, anyone can send email that looks like it’s from your domain: fake invoices, password resets, “urgent” requests to your clients.
Gmail, Yahoo and Microsoft check these records on every email. Missing or broken ones send your quotes, receipts and newsletters to spam.
Since 2024, Gmail and Yahoo require SPF, DKIM and DMARC from anyone sending email in bulk, and expect SPF or DKIM from everyone.
SPF is a list of the services allowed to send email as your domain (for example Google Workspace and your newsletter tool). DKIM adds a hidden signature to each email so receivers can tell it’s really from you and wasn’t changed. DMARC ties them together: it tells receivers what to do with email that fails (deliver, send to spam, or refuse) and sends you reports about who is sending as your domain.
It only reads public DNS records, the same ones every email receiver reads. Nothing is changed, and you don’t need to log in anywhere.
DKIM records sit under a name (a “selector”) chosen by your email provider, and DNS can’t list them. We try the common names. If yours is different, type it under “DKIM selector” and check again. Your provider’s DKIM settings show it.
Not unless you’re sure every service that sends as you passes SPF or DKIM. Start with p=none and a report address, read the reports for a few weeks, fix anything missing, then move to p=quarantine and finally p=reject.
Yes. With an All Purpose Forms account (on any plan, as an add-on) you can add addresses like info@ and sales@ at your domain and have them forwarded to the inbox you already use, like Gmail or Outlook, and reply as info@ from Gmail or Thunderbird too. Forwarded mail is signed with your domain (DKIM), and your SPF and DMARC are managed in the same place.
Look at the part just before the first single /: that’s the real site. paypal.com.secure-login.top/… is a .top site, not PayPal. Be wary of misspellings (arnazon, micros0ft), extra words (apple-id-verify), shortened links, and anything that rushes you (“your account will be closed today”). On a computer, hover over a link to see where it goes before clicking. When in doubt, type the company’s address yourself or use its app.
Not on your device. Our server asks the site only where the link leads (the redirect), never downloads the page, and never follows links to private or internal addresses. The links in your results are shown with [.] instead of dots so nobody clicks them by accident.
Yes. Unused domains are a favourite for spoofing. Add v=spf1 -all as SPF and v=DMARC1; p=reject; as DMARC to tell everyone no email should come from it.
The same team that built these free checks builds All Purpose Forms: your website, forms, payments, signing, bookings and client follow-up in one plan, with your email protected too.
We manage your SPF and DMARC for you, so scammers can’t send email as you. 1 to 5 domains on every plan.
Included on every plan. Use a domain you already own, or a free link. No web designer needed.
Describe the form and AI builds it. Take card payments and get a PDF of every submission. On Business, send the next form automatically.
Send agreements to sign, with you countersigning, and keep the signed copy with the client’s record. Pro and up.
Clients book times that check your Google Calendar (Pro and up), and you meet or present on live video (Business and up).
Contacts on every plan, plus a sales pipeline and follow-up tasks on Business.
No credit card needed. Or watch it in action and see what people use it for.