Free email health check
Check your domain's SPF, DKIM and DMARC
Type your domain or email address and we'll check the settings that stop people sending email in your name and keep your own email out of junk. It takes a few seconds, it's free and you don't need to sign up.
Your email health results
The results for your domain appear here.
Looks good
SPF record
The result and how to fix it appear here.
Needs attention
DMARC policy
The result and how to fix it appear here.
Good to know
Encrypted delivery
The result and how to fix it appear here.
What SPF, DKIM and DMARC actually do
SPF: a list, published in your domain's DNS, of the services allowed to send email as you, such as your mailboxes, your invoicing system and your newsletter tool. A domain can only have one SPF record, and it can only trigger 10 DNS lookups, which catches out a lot of businesses that have added services over the years.
DKIM: a digital signature on every email you send, checked against a public key in your DNS. It proves the email came from your domain and wasn't changed on the way. Microsoft 365 and Google Workspace both support it, but it often isn't switched on.
DMARC: ties SPF and DKIM together and tells other email services what to do with email that fails them: deliver it anyway, send it to junk or refuse it. It's the setting that stops someone sending a fake invoice in your name, and its reports show you who is sending email as you.
Why it matters now: Gmail and Yahoo started enforcing sender rules in February 2024, and Outlook.com followed in May 2025. If your domain falls short, your quotes, invoices and replies are more likely to land in junk.
FAQs
Questions about checking your email domain
Yes. It's free, you don't need to sign up and you get a plain-English report you can use yourself or pass to whoever looks after your email. If you'd like us to fix what it finds, that's a separate conversation, and we'll give you the price before any work starts.
No. We only read your domain's public DNS records, the same ones any email service looks up when a message arrives from you. We don't send any email, log in to anything or change anything, so your email carries on exactly as it was. We don't save the domains you check.
Publish a DMARC record first, set to p=none so nothing is blocked while it starts collecting reports. Then make sure SPF and DKIM cover every service that sends email as you, such as your mailboxes, invoicing system and newsletter tool, fix anything that fails, and move DMARC to quarantine and then reject. Going straight to reject is the usual way real email gets lost, so it's worth doing in stages.
The check can only test the most common DKIM selectors, because a domain can name its selector anything and there's no public list to look it up. If your email service uses an unusual one, we won't see it even though DKIM is working. To be sure, send an email to a Gmail address, open it, choose Show original and look for DKIM: PASS. If it says FAIL or isn't there, signing needs switching on in your email service.
In the Microsoft 365 Defender portal, go to Email & collaboration, then Policies & rules, Threat policies and Email authentication settings, and open the DKIM tab. Select your domain and switch on signing for it. Microsoft asks you to add two CNAME records to your domain's DNS first, and the switch only works once they've been published. If you'd rather we did it, send us your domain through the contact form.
Yes. Send us your domain through the contact form and we'll come back within 1 to 2 hours with what needs changing and what it would cost. We set up SPF, DKIM and DMARC, check that your real email still gets through, then move you to a policy that blocks fake email sent in your name.