Email Security Check

Scoring

We score the domain based on the presence and configuration of all four checks. A score of A means excellent email security, while F means critical configurations are missing.

The tool is easy to use. Follow these steps to analyze a domain's email security:

1. Enter the domain — Type the domain name you want to check (e.g. example.com without www or mail.)
2. Run the check — Click the button to start the analysis. The tool fetches MX, SPF, DMARC and DKIM records.
3. Review the results — Go through each section. Green indicator means configuration is correct, red or yellow shows issues.
4. Check the score — The overall score (A–F) gives a quick overview of how well the domain is protected against email fraud.
5. Implement improvements — Use the report to fix gaps with your DNS or email provider.

Email remains one of the most used communication channels for businesses and individuals. Without proper security you're vulnerable to several threats:

• Phishing — Scammers send email that appears to come from you or your business to steal passwords, payment info or sensitive data. SPF, DKIM and DMARC make it harder to spoof email.
• Spoofing — Attackers can send email that appears to come from your domain without access to your server. DMARC with reject policy blocks such email at recipients.
• Reputation — Email landing in spam damages trust in your domain. Good email security improves deliverability and protects your brand.
• Deliverability — Missing SPF, DKIM or DMARC causes legitimate email to land in spam more often. Gmail, Outlook and other services prioritize signed and authenticated email.

Here's a practical guide to strengthen your domain's email security:

• Set up SPF — Add a TXT record that specifies which IP addresses and servers are authorized to send email for the domain. Use -all for hard fail.
• Configure DKIM — Enable DKIM signing with your email provider (Google Workspace, Microsoft 365, etc.). They give you a public key to add in DNS as a TXT record.
• Enable DMARC — Create a DMARC TXT record with policy p=none first to collect reports, then p=quarantine or p=reject when you're confident.
• Monitor reports — DMARC sends reports about who sends email on behalf of your domain. Use these to detect unauthorized use and fine-tune configuration.

For businesses, email security isn't just good practice — it's part of data protection and information security requirements.

GDPR and data protection authorities require that personal data is processed securely. Email that is spoofed or falls into the wrong hands can lead to data breaches that must be reported. SPF, DKIM and DMARC reduce the risk of email being exploited for phishing or data leaks.

Many public and private organizations now require that vendors have good email security. Showing that your domain has correct SPF, DKIM and DMARC can be a requirement in tenders and contracts. Use the email security check to document that you meet the requirements.