F09 TechFree Tools
Start assessment

Free tool · No sign-up

Free Email Security Checker

Find out in seconds whether scammers can send email pretending to be you. We check your SPF, DKIM and DMARC records and show you exactly what to fix.

Why email security matters for small businesses

Email was built without any way to prove who sent a message. Anyone can put your address in the From line, and without the right DNS records, mail servers have no way to tell the difference. Scammers use this to send fake invoices, payment change requests and password-reset phishing that looks like it came from you.

The same records also decide whether your real email reaches the inbox. Google, Yahoo and Microsoft now check them, and email from domains without them is more likely to land in spam.

What are SPF, DKIM and DMARC?

SPF (Sender Policy Framework)

A TXT record that lists the servers allowed to send email for your domain, such as Google Workspace, Microsoft 365 or your newsletter service. Receiving servers compare the sending server against this list.

DKIM (DomainKeys Identified Mail)

A digital signature added to every email you send. Your provider signs each message with a private key, and receivers check the signature against the public key in your DNS. It proves the message wasn't forged or changed in transit.

DMARC (Domain-based Message Authentication, Reporting and Conformance)

The policy that ties SPF and DKIM together. It tells receivers what to do when a message claiming to be from you fails both checks: deliver it (none), send it to spam (quarantine) or block it (reject). It also sends you reports about who is using your domain. DMARC set to quarantine or reject is what actually stops spoofing.

How to read your results

  • Grade A or B with "Protected": your domain is hard to spoof. Review any items marked Needs work.
  • "Partly protected": DMARC is enforced, but SPF or DKIM has problems that can hurt delivery of your own email.
  • "At risk", grade D or F: DMARC is missing or only monitoring. Fix this first, starting with the DMARC record shown in the results.

Every problem comes with the DNS record to add or change. Copy the report and send it to whoever manages your domain's DNS.

Frequently asked questions

What does this email security checker test?

It looks up your domain's public DNS records and checks SPF, DKIM and DMARC, the three standards that stop other people from sending email as your domain. It also checks your mail servers and three extra protections: MTA-STS, TLS reporting and BIMI.

Is it safe to check my domain?

Yes. The checker only reads DNS records that are already public, the same records every mail server reads when you send email. Your browser looks them up through Cloudflare's public DNS service. F09 Tech doesn't receive or store the domains you check.

Why can't the checker find my DKIM record?

DKIM records live under a selector name chosen by your email provider, and there's no way to list them from DNS. We try the selectors used by Google Workspace, Microsoft 365 and other common services. If you use a custom selector, enter it under Advanced. If you never turned DKIM on in your email provider, there's nothing to find.

What DMARC policy should I use?

Start with p=none and a rua address so you receive reports without affecting delivery. After two to four weeks, once your legitimate senders pass, move to p=quarantine and then p=reject. Only quarantine and reject actually stop spoofed email.

What is the SPF 10 lookup limit?

Receivers stop evaluating SPF after 10 DNS lookups, and each include, a, mx and redirect counts, including the lookups inside the services you include. Go over the limit and SPF fails for all of your email. Remove includes for services you no longer use.

Will changing these DNS records break my email?

Adding SPF and DKIM and starting DMARC at p=none won't block anything. The risk comes from moving DMARC to quarantine or reject before every service that sends email for you passes SPF or DKIM, which is why you should read the reports first. If you're unsure, get help before tightening the policy.

Do Google and Yahoo require SPF, DKIM and DMARC?

Since 2024, Google and Yahoo require every sender to have SPF or DKIM, and bulk senders, those sending about 5,000 or more messages a day to their users, to have SPF, DKIM and a DMARC record. Microsoft introduced similar rules for high-volume senders to Outlook.com in 2025. Even small senders see better inbox placement with all three.

More free tools