Can someone send email as you?
Fake invoices and password resets usually come from domains that never set SPF and DMARC. Enter your website or domain and see whether yours is protected.
What it checks
- SPF: whether the domain lists the servers allowed to send its email, and how strict it is (-all, ~all, ?all or +all)
- DMARC: whether mail providers are told to reject, quarantine or only report email that fakes your domain
- Mail servers (MX), and how to lock down a domain that doesn't send email at all
- Common mistakes: two SPF records, too many lookups, partial DMARC (pct below 100)
Questions
What about DKIM?
DKIM signs your email, and its record sits under a name only your email provider knows (a selector), so it can't be checked from outside. Your provider's setup guide shows how to turn it on; DMARC works best with SPF and DKIM together.
Will p=reject stop my real email?
It can, if a service that sends for you (a newsletter tool, your booking system) isn't in SPF or signed with DKIM. That's why you start with p=none, read the reports for a few weeks, then tighten it.
Where do I add these records?
Wherever your domain's DNS is managed: your registrar (GoDaddy, Namecheap, IONOS…), Cloudflare, or your host. They are TXT records.
More free tools
- AI crawler checkerCan AI tools read your site?
- Security headers checkerCheck your security headers
- Social preview checkerSee your link before you share it
- llms.txt generatorMake an llms.txt for your site
- Redirect checkerCheck how your site redirects
- Schema checkerCheck your structured data
- Alt text checkerCheck your images' alt text