Free · No sign-up · 30 seconds
Enter your domain to see whether the settings that stop email spoofing (SPF and DMARC) are in place. We also score your certificate and website settings at the same time.
The "From" address on an email can actually be faked. If your domain is not protected, anyone can send email that claims to come from "info@yourcompany.com". A common scam is sending your clients a fake invoice that asks them to pay into a different bank account.
Three settings stop this. All of them go in your DNS (your domain settings), so nothing on your server needs to change.
SPF
The list of servers allowed to send email for your domain
You add one line starting with "v=spf1 …" to your DNS. Email sent from a server that is not on the list looks suspicious to the receiving side.
DKIM
A digital seal stamped on every email
Your outgoing email gets a signature, so receivers can confirm it was not altered on the way and really came from your domain. You turn it on in the admin screen of the email service you use.
DMARC
Your instructions for what to do with email that fails SPF and DKIM
You add "v=DMARC1; p=…" to the "_dmarc" entry in your DNS. Tighten it step by step: p=none (just watch) → p=quarantine (send to spam) → p=reject (refuse). The reports you receive also show who is sending email in your name.
| Your email service | SPF example (add as a DNS TXT record) |
|---|---|
| Google Workspace | v=spf1 include:_spf.google.com ~all |
| Microsoft 365 | v=spf1 include:spf.protection.outlook.com -all |
| Email from your web hosting company | The value in your host's help pages (it differs from host to host) |
| A domain that never sends email | v=spf1 -all |
If a newsletter service, booking system or similar also sends email for you, add its include to the same line. A domain can have only one SPF line (two lines make it invalid).
_dmarc.yourdomain.com TXT v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
Read the reports for a few weeks. Once every legitimate sender is covered by SPF and DKIM, change it to p=quarantine, and then to p=reject.
Fake invoice emails sent to clients and customers in a company's name are a common scam. Without DMARC, the recipient's email program cannot tell the fake from the real thing. Major providers such as Gmail and Yahoo also now require senders to set up SPF, DKIM and DMARC, so without them even your genuine emails are more likely to land in spam.
Yes. Unused domains are among the easiest to abuse. Add these two lines to its DNS: "v=spf1 -all" (nothing is allowed to send) and "v=DMARC1; p=reject" (refuse email that does not match).
We do not recommend it. Newsletters, booking systems and other services may be sending email with your domain without you realizing. Start with p=none, read the reports for a few weeks, add every legitimate sender to SPF and DKIM, and only then tighten the setting.
Whoever manages your DNS (your domain settings). That is usually the admin panel of the company you bought the domain from, or the agency or hosting company that runs your website. In the Security Ready in-depth scan, we show you how to fix it for your setup, plus a ready-to-send request you can forward to them.
Check your settings in 30 seconds
Besides SPF and DMARC, the 30-second quick check also scores your certificate, website settings and forgotten entry points. No sign-up needed.
Want us to keep watch every day and alert you if these settings disappear or get weaker? Start with the free in-depth scan (first one free).