Free tool
Email security check
Enter your domain. We check your SPF, DKIM, DMARC, and other email security records and score them out of 100. See right away how likely your emails are to land in spam or be spoofed.
Last updated: 18 September 2026
Lookups run from your browser against public DNS records; your domain is not sent to us.
What does the test check?
| Record | What it does | What happens if it is missing |
|---|---|---|
| SPF | Lists which servers may send email on behalf of your domain. | Others can easily send email pretending to be you. Your mail can land in spam. |
| DKIM | Digitally signs outgoing email. | The recipient cannot verify that the message was not altered in transit. |
| DMARC | Defines what happens to mail that fails SPF and DKIM, and sends reports. | Spoofed mail is not blocked and you are not notified. |
| MTA-STS | Enforces encryption for mail transmitted between servers. | Delivery can be downgraded to an unencrypted path. |
| TLS-RPT | Reports encryption issues. | You do not notice the problems. |
| BIMI | Displays your logo in supporting inboxes. | Optional. You miss out on brand visibility. |
SSS
Frequently asked questions
Is DMARC "p=none" enough?
It is the right first step, but it does not provide protection on its own. It only collects reports. Once the reports are reviewed and all legitimate sending sources are added to SPF and DKIM, the policy should be tightened first to "quarantine" and then to "reject".
I have a DKIM record but the test did not find it. Why?
The test checks common selector names (google, selector1, selector2, default, k1). If your email provider uses a different selector, the record may exist but not be found. The s= value in the "DKIM-Signature" header of an outgoing email shows your selector.
I have two SPF records. Is that a problem?
Yes. A domain should have only one SPF record. If there are two, SPF is treated as invalid. All include statements must be merged into a single record.
Does testing my domain send information to you?
No. Queries are made from your browser to public DNS records. If you want to share the result with us, you can use the form that appears after the test.
Related pages
Business emailGmail with your own domain, including MX, SPF, DKIM, and DMARC setup.Security consultingSecurity assessment and hardening for Workspace and Google Cloud.Security and backupTwo-step verification, DLP, device management, and real backup.Google WorkspaceGmail, Meet, Drive, Docs, and Gemini in one plan, with your own domain.Managed supportOngoing, contracted support in Turkish for Workspace and Google Cloud.ContactReach us for quote, migration, and support requests.