Email security check
Runs in every scan · 8 checks
See whether others can send email as your domain, and the exact records that close the gap. Read from your public DNS, nothing to install.
What we check
Part of every Quick Scan, alongside the other checks.
Present, valid, and ending with a clear rule for unknown senders.
Published, readable, enforcing, and covering your subdomains too.
A reporting address is set, and authorised when it is on another domain.
The keys we can find, and whether they're long enough.
Each one exists, is a proper name, and the records agree.
Locked down so nobody can send as them.
Incoming mail kept encrypted in transit, with reports switched on.
Your brand logo record, when you publish one.
Why it matters
Receiving servers can turn away mail that only pretends to be you.
Mailbox providers look for these records on the mail they accept.
DMARC reports show which services send mail as your domain.
What a finding looks like
F3 · dns-email-auth
_dmarc.example.com TXT (no record)_dmarc.example.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"F8 · dns-email-auth
example.com TXT v=spf1 include:_spf.mail.example -allHow to fix it
Your report has the exact fix for your site, ready to forward to whoever looks after it.
List every service that sends email for you: your mailbox provider, newsletter tool, shop and booking system.
Publish one SPF record that includes them all, ending in ~all or -all.
Turn on DKIM signing in each sending service and publish the key it gives you.
Publish DMARC with p=none and a report address. Read the reports for a few weeks, then move to quarantine or reject.
example.com. TXT "v=spf1 include:_spf.mail.example ~all"
_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com"SPF is a list of the servers allowed to send email for your domain. DKIM adds a signature to each message so receivers can tell it wasn't changed. DMARC ties the two to the address people see in the From line and tells receivers what to do when a message fails: deliver it, send it to spam or refuse it.
Start with p=none and a report address so you can see who sends mail as you without affecting delivery. Once every genuine sender passes, move to p=quarantine, then p=reject for the strongest protection.
Yes, it's the quickest win there is. Publish v=spf1 -all and a DMARC record with p=reject, and receivers will refuse any mail that claims to come from the domain.
Receiving servers will only follow a limited number of includes and redirects in an SPF record (ten, by the standard). Remove services you no longer use, or ask a sender for a narrower include.
DKIM keys are published under names each mail service chooses, and there's no public list of them. We check the common ones and the report lists the keys we found, so you know exactly what was covered.
Keep exploring
Also useful: What we check Sample report Pricing For small businesses
One report, a fix for every finding