Free tools
Free email security tools, one record at a time.
Four free checkers, one for each record. Type in a domain and we read the record from public DNS, grade it as the Full Report does and show how to fix what is wrong.
- Reads only public DNS
- No account, nothing to install
TXT · your domain
SPF checker
Reads the record that lists the servers allowed to send email as you, and counts the DNS lookups it costs.
Check SPFTXT · _dmarc
DMARC checker
Reads your instruction to inboxes about mail that fails, and whether its reports reach anyone.
Check DMARCTXT · selector._domainkey
DKIM checker
Reads the public keys that prove your email was signed by you, on the common selectors or your own.
Check DKIMTXT · _mta-sts · policy file
MTA-STS checker
Reads the policy that asks senders to deliver mail to you only over an encrypted connection, and your TLS reporting.
Check MTA-STS
How the four records fit together
SPF and DKIM each prove that a message came from you: SPF by the server that sent it, DKIM by a signature only your mail service can make.
DMARC ties them to the From address people read, and tells inboxes what to do with mail that fails. Without it, each inbox decides for itself.
MTA-STS protects the other direction: mail sent to you. It asks senders to deliver only over an encrypted connection to the servers you name.
Each one in more depth: SPF, DKIM and DMARC explained, and MTA-STS and TLS reporting explained.
Or check every record at once.
The free check reads all four records, and your website and DNS, in about 30 seconds. You get a score out of 100 with the reasons in plain English.