Stop Attackers Spoofing Your Domain
Check your email authentication — SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI — in one scan. Find the gaps that let attackers send phishing as your domain, and get exact fixes to lock it down.
Free instant check · No signup needed · See how it works
What the Email Security Check Covers
The full email authentication stack — the records that decide whether your domain can be spoofed.
SPF Record
Whether your SPF record exists, is valid, avoids the 10-DNS-lookup limit, and ends in a strict -all.
DKIM Signing
Whether outgoing mail is DKIM-signed with a valid public key so receivers can verify it wasn't tampered with.
DMARC Policy
Whether DMARC is published, the enforcement level (none/quarantine/reject), and reporting — the record that stops spoofing.
MTA-STS, TLS-RPT & BIMI
Enforced TLS for inbound mail, TLS failure reporting, and verified brand logos in the inbox.
How It Works
Enter your domain
No agents, no config — just your domain name.
We run the checks
Every check runs concurrently and finishes in under 2 minutes.
Get your grade + fixes
A clear A–F grade with prioritised, step-by-step remediation.
Email Security Checker — FAQ
What is an email security checker?
It inspects your domain's email authentication records — SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI — to confirm attackers can't spoof your domain and that your legitimate mail is trusted. SecurityStatus checks all of them free.
How do I check my SPF and DMARC records?
Enter your domain and the scan reads your published DNS records, validates SPF (including the 10-lookup limit), confirms DKIM signing, and reports your DMARC policy and enforcement level — with exactly what to fix.
Why does email authentication matter?
Without SPF, DKIM, and an enforced DMARC policy, anyone can send email that appears to come from your domain — the basis of phishing and business email compromise. Proper records stop spoofing and improve deliverability.
What is a good DMARC policy?
Aim for p=reject (or at least p=quarantine) once you've confirmed legitimate mail passes. A policy of p=none only monitors — it doesn't block spoofed mail. The checker tells you where you stand and how to move to enforcement safely.
Is the email security check free?
Yes — SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI are all checked free as part of your domain scan, with a grade and remediation steps. No credit card required.
Check Your Email Security Now
See whether your domain can be spoofed — and get the SPF, DKIM, and DMARC fixes to stop it.
Check My Email Security Free