What are SPF, DKIM and DMARC?

They're three DNS records that prove your email is genuinely from you. SPF lists which servers may send mail for your domain; DKIM cryptographically signs your messages; DMARC tells receiving servers what to do with mail that fails those checks, and sends you reports. Together they stop scammers spoofing your domain.

Why does my email domain need these?

Without them, anyone can send email pretending to be your domain — damaging your reputation and putting your clients at risk. They also improve deliverability: Google and Microsoft increasingly reject or spam-bin mail from domains without proper authentication.

What should I do if my score isn't an A?

Anything below an A suggests your current setup isn't following best practice. The fixes are DNS changes that should be made carefully — getting SPF or DMARC wrong can stop your legitimate mail being delivered. We can audit, fix and monitor all three for you as part of our managed service.

Why couldn't the tool find my DKIM record?

DKIM uses a 'selector' that's unique to your mail provider, and there's no way to discover it automatically. We check the common ones, but if yours isn't found, enter your selector in the tool to check it directly — a miss doesn't necessarily mean DKIM is missing.

Free tool

Email deliverability audit.

Is your email domain configured correctly? Scammers send emails pretending to be you — damaging your reputation and putting your clients at risk. Check your SPF, DKIM and DMARC in seconds.

Check your domain

Enter your domain to grade your email security.

We check the three DNS records that prove your email is really from you. If you score anything below an A, your current IT provider probably isn't being proactive about protecting your business.

The check runs in your browser against public DNS records. We don’t store your domain or send it anywhere except the DNS lookup.

What we check

The three records that stop spoofing.

SPF

Lists which mail servers are allowed to send email for your domain. Without it, anyone can.

DKIM

Adds a tamper-proof digital signature to your mail, so receivers can confirm it wasn't forged or altered in transit.

DMARC

Tells receiving servers what to do with mail that fails SPF or DKIM — and sends you reports on who's sending as you.

Common questions

Email authentication, explained.

Start here

Let's talk.
We'll be straight.

Tell us a bit about your business and what's on your mind. We'll have a straight conversation about your IT — what you've got, what we'd do differently, and whether we're the right fit for each other.

A human picks up on the first call
No pitch deck — just a proper conversation
We'll tell you honestly if we're not the right fit