Free Email Security Checker: An SPF, DKIM, DMARC, and MX Scan
Is Your Business Susceptible to Email Spoofing?
Use the email domain security grader below to find out in about 15 seconds whether criminals can send email that claims to be your company.
Enter your business domain and we read the public DNS records, SPF, DMARC, DKIM, and MX, that every mail server on the internet already checks. You get a letter grade and a plain-English breakdown of exactly what to fix.
No sign-up to see your result.
What the Grader Actually Checks:
The grader reads four public DNS records from your domain and assigns a grade A through F based on how well they work together to block imposters. Here is what each record does and why it matters.
MX records tell the internet which mail servers receive email sent to your domain. The grader confirms you have at least one configured. A domain with no MX records is unusual and can signal an abandoned or misconfigured domain.
SPF (Sender Policy Framework) is a DNS record that lists every server and service authorized to send email on your domain’s behalf. Without it, any server on the internet can send a message with your domain in the From line and most receiving servers will let it through. The grader checks whether your SPF record exists and whether it ends with a hard-fail (`-all`), a soft-fail (`~all`), or something weaker.
Strict (`-all`): tells receiving servers to reject anything that isn’t on your approved list. Strongest protection.
Soft-fail (`~all`): marks unapproved senders as suspicious but still delivers the message. Common during a migration; not a permanent configuration.
Missing or weak: no policy, or `+all` or `?all`, which tell receiving servers to accept anything. Wide open to spoofing.
DMARC (Domain-based Message Authentication, Reporting, and Conformance) is the enforcement layer. It tells receiving servers what to do with a message that fails SPF and DKIM: reject it outright (`p=reject`), send it to spam (`p=quarantine`), or deliver it anyway and just send you a report (`p=none`). Without a DMARC record, there is no enforcement regardless of what your SPF says. The grader checks whether your DMARC record exists and what policy it sets.
DKIM (DomainKeys Identified Mail) puts a cryptographic signature on every outbound message so the receiving server can verify the message really came from your mail system and was not altered in transit. The grader probes common signing selectors used by Microsoft 365, Google Workspace, and Mailchimp. A miss means we could not find a key at the standard selectors, it does not necessarily mean DKIM is absent, since some providers use custom selectors.
How Your Grade is Calculated:
The grader uses a cascade: the first rule that matches wins.
- A.
✓ SPF hard-fails imposters, DMARC is set to reject or quarantine, and we found a DKIM signing key. Your domain is as locked down as DNS allows.
- B.
✓ Real protections are in place. Either DKIM was not detected at the common selectors, or DMARC is in a managed rollout (policy `none` with an explicit `pct`). One step from fully locked down.
- C.
–SPF exists and is usable, but DMARC policy is `none`, meaning you are monitoring spoofed mail and letting it through anyway. Moving to `quarantine` or `reject` is usually one DNS change once your legitimate senders are lined up.
- D.
–Something is present but the combination leaves room for an imposter. SPF may be weak or missing, DMARC may be absent, or both have gaps. Fixable in an afternoon by whoever manages your DNS.
- F.
–No SPF and no DMARC. Any server can send email as your domain and most receiving servers will deliver it. The highest risk of all five grades.
How to Read Your Grade and What to Fix First:
- A or B
Keep it this way. Re-check whenever you change email providers, add a marketing tool that sends on your behalf, or update your DNS. Every new sending service needs to be added to your SPF record.
- C
You have SPF in place but DMARC is in monitoring-only mode (`p=none`). The fix is to move to `p=quarantine` or `p=reject` after reviewing the DMARC aggregate reports to make sure all your legitimate senders pass. Your IT provider or email administrator can do this.
- D or F
The gaps in the breakdown are fixable DNS changes. SPF is a single TXT record on your root domain. DMARC is a single TXT record at `_dmarc.yourdomain.com`. Neither requires touching your email servers. The work is usually under an hour for the IT department or whoever manages your DNS.
A note on DKIM: if the grader shows DKIM as not detected, do not assume it is missing. We probe the standard selectors for Microsoft 365 (`selector1`, `selector2`), Google Workspace (`google`), and Mailchimp (`k1`).
If your provider uses a custom selector name, we will not find it.
Check with your email administrator or IT provider to confirm DKIM is configured on your sending domain.
Why Domain Spoofing is a Real Problem for Small and Mid-Sized Businesses
Business email compromise (BEC), where criminals send email posing as a company you trust, cost businesses $2.77 billion across 21,442 U.S. incidents reported in 2024. (Source: FBI Internet Crime Report (IC3), 2024.) Your own domain is the attack surface: if the DNS records above are weak or missing, a criminal can send invoices, wire-transfer instructions, or vendor impersonation emails that appear to come from your address.
Your customers, partners, and employees see your domain in the From line. The three records this grader checks, SPF, DMARC, and DKIM, are the only public controls that tell the world’s mail servers who is allowed to send as you and what to do when something fails. They are free to configure, they live in your DNS, and they do not require changes to your mail servers. A domain without them is a domain anyone can impersonate.
Email Domain Security Grader FAQ
The grader reads four public DNS records from your domain using Google’s DNS-over-HTTPS API, the same records every mail server on the internet reads before deciding whether to deliver a message. It checks whether your MX records exist, whether your SPF record exists and how strict it is, whether your DMARC record exists and what enforcement policy it sets, and whether it can find a DKIM signing key at the common selector names used by Microsoft 365, Google Workspace, and Mailchimp. It assigns a letter grade A through F based on how well those records work together to block spoofing.
SPF defines which servers can send email as your domain. DKIM adds a cryptographic signature to each message so receivers can verify it is authentic and unmodified. DMARC is the enforcement rule: it tells receiving servers what to do when a message fails SPF or DKIM, and it gives you reporting so you can see who is sending as your domain. All three records live in your DNS. SPF and DMARC work at the domain level; DKIM works at the message level. You need all three working together to lock down a domain against spoofing.
Email delivery works independently of spoofing protection. You can send and receive email just fine with no SPF, no DMARC, and no DKIM, but so can anyone else who wants to impersonate your domain. The grade reflects how protected your domain is against spoofing, not whether your email works.
Yes, if DMARC is missing or set to `p=none`. SPF tells receiving servers which senders you authorize, but without a DMARC policy that says to reject or quarantine failures, many servers will deliver the message anyway. DMARC is what gives SPF (and DKIM) teeth. That is why a C grade, SPF present, DMARC policy `none`, still leaves your domain spoofable in practice.
Not necessarily. The grader probes the selector names used by the four most common sending platforms (Microsoft 365, Google Workspace, Mailchimp). If your provider uses a different selector name, we will not find it and the result will say “not detected” rather than “absent.” Check with your email administrator or IT provider to confirm whether DKIM is configured and which selector they use.
In most cases, under an hour. SPF and DMARC are DNS TXT records, your IT team or the person who manages your domain registrar account can add or update them from a control panel. DKIM setup depends on your email provider but is usually a guided process in the admin console (Microsoft 365 admin center, Google Workspace admin, etc.). The main reason to go carefully is to make sure all your legitimate sending services, marketing email, accounting software, CRM, are included in your SPF record before you set DMARC to reject.
Yes. A domain that sends no email is actually a high-value spoofing target because it has no legitimate traffic that a DMARC reject policy would interrupt. Setting SPF to `v=spf1 -all` (no senders authorized) and DMARC to `p=reject` takes minutes and tells the world’s mail servers to reject everything that claims to be your domain.
Ready to close your gaps?
If your domain graded C, D, or F, the fixes are DNS changes, not an email migration or a new product. The part that takes time is making sure every service that sends email on your behalf is covered before you move DMARC to reject. That is the kind of thing a good IT partner just handles. LeadingIT has helped Chicagoland businesses lock down their email domains and stay protected since 2010.
Email yourself the full report from the grader above, book a free 30-minute call, or contact us.