Vanorika Technologies

Free tool

Email Security Checker

Is someone able to send email pretending to be your business? Check your SPF & DMARC in seconds.

Read-only and passive. We only query public records: no login, no port scanning, no exploitation.

What this checks

  • Reads the TXT records at your domain root and finds your SPF record (the one starting v=spf1).
  • Reads the TXT record at _dmarc.yourdomain and extracts the DMARC policy: none, quarantine or reject.
  • Lists your MX records, the servers that receive mail for the domain.
  • Combines these into a posture score, giving more weight to DMARC at quarantine or reject than at none.

Why it matters

Without SPF and an enforcing DMARC policy, anyone can send email that claims to come from your domain, and receiving servers have no instruction to reject it. That is how fake invoices, changed bank details and fee payment scams reach suppliers, parents and patients under a real organisation's name. These are free DNS records, and once in place they also help your genuine mail land in the inbox rather than spam.

How to read the result

  • No SPF found means receiving servers cannot tell which servers are allowed to send for you.
  • A DMARC policy of p=none only monitors. It produces reports but does not stop spoofed mail, which is why it scores lower than quarantine or reject.
  • No MX records means the domain receives no email at all, which is fine for a parked domain but wrong for one your staff use.
  • This tool does not test DKIM, because DKIM keys sit under selector names only your mail provider knows. Check DKIM in your provider's admin console.

How to fix what it finds

  • Publish one SPF record that includes every service that sends mail as you, such as include:_spf.google.com for Google Workspace, ending in ~all or -all.
  • Turn on DKIM signing in Google Workspace, Microsoft 365 or Zoho and publish the key they give you.
  • Publish DMARC at p=none with a rua reporting address, review the reports for a couple of weeks, then move to p=quarantine and later p=reject.
  • Give parked domains that never send mail an SPF of v=spf1 -all and a DMARC of p=reject, so they cannot be used for spoofing either.

Want it fixed for you, or tested properly? See what a test would cost or book a free 30 minute call.

Questions people ask

How do I know if someone can spoof my email domain?

If this tool finds no SPF, no DMARC, or DMARC set to p=none, receiving servers have no instruction to block forged mail from your domain. An enforcing DMARC policy of quarantine or reject is what closes that gap.

Can I have two SPF records?

No. RFC 7208 says a domain must publish only one SPF record, and two records cause SPF to fail with a permanent error. Merge all your include mechanisms into a single record.

Will DMARC reject my own legitimate emails?

It can if a service that sends for you, such as a newsletter platform or accounting system, is missing from SPF and not DKIM signing for your domain. Starting at p=none and reading the reports first is how you find those senders safely.

Related free tools