Email Security Check

Fraudsters like to send e-mails that look as if they came from you: fake invoices to your customers, payment requests to your accounts department. Whether that works depends on a few records in your domain’s DNS. They also decide whether your genuine e-mails reach Gmail, Yahoo and Outlook or end up in spam. The check shows within seconds how well your domain is protected.

Enter your domain, your website or an e-mail address. We only use the domain.

How to read the result

At the top you see the domain checked, the e-mail provider detected and how strictly your spoofing protection is set. Below that, every record follows with a traffic light. Red only appears when a record is definitely missing or invalid. If the DNS server does not respond, we show this as a note, not as an error.

OK
This point is implemented correctly.
Review
Not an acute error, but room for improvement.
Problem
Likely has a negative effect and should be fixed.
Info
For information, without rating.

01
Mail servers (MX)
The MX record says where e-mails to your domain are delivered. It also tells us your provider, for example Microsoft 365, Google Workspace or World4You. If the domain has no mail server, it receives no e-mail and should be protected against misuse.
02
SPF
SPF lists the servers allowed to send in your name. We check whether there is exactly one record, whether it is free of errors, how it ends (-all, ~all or the ineffective ?all or +all) and how many DNS lookups it needs including all references. More than 10 make SPF invalid.
03
DMARC
DMARC defines what happens to e-mails that fail SPF and DKIM: nothing (p=none), spam folder (quarantine) or rejection (reject). With “rua” you receive reports on who sends in your name. If DMARC is missing, we provide a record to start with.
04
DKIM
DKIM signs your e-mails digitally. The key is stored in DNS under a freely chosen name (selector). We only query common selectors, such as those of Microsoft 365 and Google. If we find none, that does not mean DKIM is missing. That is why this item is never red.
05
MTA-STS and TLS-RPT
MTA-STS forces other mail servers to deliver e-mails to you only encrypted, TLS-RPT reports problems with this. Both are optional for most small businesses. If MTA-STS is set up, we check whether the policy is reachable and covers all mail servers.
06
BIMI
With BIMI your logo appears next to your e-mails in the inbox. It requires a strict DMARC and, for Gmail, also a paid brand certificate. We only show whether it is set up.
07
A badge for your website
If SPF is valid and ends with -all or ~all, DMARC is set to p=quarantine or p=reject and there are no red points, we offer you a badge to embed below the result, light or dark and in three sizes. The code is plain HTML without scripts, cookies or tracking. The badge links to this check with your domain, and a click runs the check again. That way it always shows the current state and cannot be faked. Whether you use it is entirely up to you.

Why e-mail security is a management issue

Phishing with your own domain is one of the most common scams against small and medium-sized businesses. An e-mail apparently from the managing director, a changed bank account on an invoice: without SPF and DMARC hardly any recipient checks whether the e-mail really comes from you.

Since February 2024 Gmail and Yahoo have applied stricter rules for senders. Everyone needs SPF or DKIM, and those who send many e-mails also need DMARC. Microsoft is following suit for Outlook.com. Without these records, offers, invoices and newsletters end up in spam or are rejected more often.

The good news: the records cost nothing and are quickly created in the DNS settings of your domain provider. Only the order matters: first list all services that send in your name (mailbox, website forms, newsletter, invoicing software), then start DMARC with reports, and only tighten it afterwards.

What good records look like

# SPF (TXT on your-domain.com)
v=spf1 include:spf.protection.outlook.com -all

# DMARC (TXT on _dmarc.your-domain.com)
v=DMARC1; p=quarantine; rua=mailto:dmarc@your-domain.com

# Domain without e-mail
v=spf1 -all
v=DMARC1; p=reject

The SPF example applies to Microsoft 365. If you use other services that send in your name, their entries must be added. Start DMARC with p=none and reports before raising it to quarantine or reject.

Frequently asked questions about SPF, DKIM and DMARC

What is the difference between SPF, DKIM and DMARC?

SPF says which servers may send for your domain. DKIM adds a digital signature to every e-mail. DMARC connects both and defines what happens to e-mails that pass neither test. Only all three together protect effectively against forged senders.

Where do I enter the records?

In the DNS settings of the provider where your domain is registered, which is often not your e-mail provider. Create a record of type TXT there. For DMARC the record is called “_dmarc”, for SPF the name stays empty or is “@”. Changes usually take effect within minutes, at the latest after a day.

Can DMARC stop my own e-mails from arriving?

Not with p=none, which only creates reports. Only quarantine or reject filter out e-mails that fail SPF and DKIM. So evaluate the reports for a few weeks first, add forgotten services such as the website’s contact form or the newsletter tool, and then tighten it.

Why does the check not find my DKIM key?

The key name (selector) can be chosen freely and cannot be listed from outside. We only query common names. You can find the right one in the header of a sent e-mail under “DKIM-Signature” after “s=”. In Microsoft 365 you activate DKIM in the Defender portal, in Google in the Admin console.

What does the limit of 10 DNS lookups for SPF mean?

Every reference in the SPF record (include, a, mx, redirect) triggers another DNS lookup at the recipient, nested references count too. More than 10 are not allowed by the standard, SPF is then considered invalid. That happens quickly when newsletter, shop and CRM services are added over the years.

My domain does not send any e-mail. Do I still need this?

Yes, especially then. Fraudsters like to use unprotected domains as senders. With “v=spf1 -all” and “v=DMARC1; p=reject” you tell every mail server: no genuine e-mail ever comes from this domain. This also applies to old or additionally registered domains.

Can I show the result on my website?

Yes, if SPF and DMARC are set up well and no point is red. Below the result you copy a short HTML code, for example for your footer. We store nothing for this. The badge links to this page with your domain, and a click runs a new check. If something is still missing, the check tells you what. Using the badge is voluntary.

Is my input stored?

We only query public DNS records of your domain (MX, SPF, DMARC, a sample of DKIM keys, MTA-STS, TLS-RPT, BIMI). If MTA-STS is set up, we also load the public policy from mta-sts.your-domain. We do not read your e-mails and send no test e-mail. If you enter an e-mail address, we only use the domain after the @, the name in front is discarded and not stored. We store the checked domain and the result anonymously for statistical purposes, but not your IP address. More in our privacy policy.

E-mails that arrive and cannot be forged

As a web agency in Vienna, we take care of your domain, DNS and the technical side of your online presence: from SPF, DKIM and DMARC to website forms that deliver reliably and ongoing maintenance.

Get in touch