Toolkit
Free DMARC Checker
Check your SPF, DKIM and DMARC records in about ten seconds. It tells you whether someone can send email pretending to be you, what is missing, and exactly what to publish to fix it. No signup, and it checks your security headers while it is there.
Reads public DNS records and response headers only. No login, no scanning, nothing intrusive, the same information any mail server sees.
What this checks, and what it doesn't
It checks
- SPF, who may send email as your domain
- DKIM, whether your mail is cryptographically signed
- DMARC, what happens to mail that fails those checks
- MTA-STS and DNSSEC
- HSTS, CSP and the other security response headers
- Whether your software versions are advertised publicly
It cannot see
- Endpoint and server patching
- Identity and access configuration, MFA coverage
- Backup integrity and restore testing
- Whether your staff would spot a phish
- Anything behind a login
That second list is where most incidents actually begin. A clean result here is a good sign, not an all-clear.