SPF
The list of services allowed to send email as your domain: Microsoft 365, your accounts package, your newsletter tool. Email from anywhere else fails.
Free tool
Can somebody send email pretending to be you?
Put in your domain and we will look up the three records that decide whether a forged email from your address gets delivered, SPF, DKIM and DMARC, then tell you in plain English what each one says and what to fix. Free, no sign up, and nothing is kept.
Check a domain
Is your domain protected from spoofing?
What it checks
What are SPF, DKIM and DMARC?
Three public records in your domain’s settings. Together they let any email system tell a message that really came from you from one that only claims to. Each takes minutes to publish, and none of them costs anything.
DKIM
A signature added to every message you send, which the receiver checks against a key you publish. It proves the message came from your system and was not changed on the way.
DMARC
The instruction that ties the other two together: what a receiver should do with email that claims to be from you and fails both checks. Without it, the answer is usually “deliver it anyway”.
Who handles your email
We also look up where your email is delivered, so the fixes can say where to make them. Microsoft 365 and Google Workspace each do this slightly differently.
Questions
The things people ask first
What should my DMARC policy be?
p=reject, eventually. That tells receivers to refuse email that claims to be from you and fails the checks, and it is the end point the National Cyber Security Centre recommends. Get there in steps: p=none with a reporting address first, to find everything that sends email as you, then p=quarantine, then p=reject.
Can turning on DMARC stop my own email arriving?
Yes, if you go straight to quarantine or reject. Invoicing systems, newsletter tools, booking software and the office scanner often send email as you, and if they are not in your SPF record or signing with DKIM, an enforced policy treats them as forgeries. That is why the reports come first. They show you every service sending as you before anything is blocked.
Why does it say DKIM was not found when I think it is on?
DKIM keys sit under a name chosen by whoever sends your email, and there is no public list of them. We look in the places Microsoft 365 and Google Workspace use. If your email goes through another service, it may well be set up under a name we did not try. Your email provider can tell you for certain.
Is it all right to check a domain that is not mine?
Yes. These records are published so that every email system in the world can read them, and looking them up is exactly what happens each time somebody receives an email. Checking a supplier before you pay their invoices is a sensible thing to do.
Do you keep the domains people check?
No. The domain is looked up through Cloudflare’s public DNS service, the result is built into the page, and then both are dropped. Nothing is written to a database and there is no cookie. The privacy notice says the same.
Next step
Want it fixed without breaking your email?
Tell us what sends email as your business and where your domain is registered. We will tell you what needs changing and in what order, so nothing genuine gets blocked on the way.