Free tool · by AlphaIT
Free Email Security Checker
Can scammers send email that looks like it came from your company? Type your domain and see your SPF, DKIM and DMARC setup in seconds, with a grade and plain-English fixes.
What the checker looks at
Four DNS Records Decide Whether Your Domain Can Be Faked
Email was built without any proof of who sent it. These records, published in your domain’s DNS, are how receiving servers like Gmail and Outlook tell your real email from a fake.
SPF: the guest list
A list of the services allowed to send email as your domain, such as Microsoft 365, your newsletter tool and your invoicing software. Only one SPF record is allowed, and it can trigger at most 10 DNS lookups.
DKIM: the signature
Your mail service signs every message with a private key, and publishes the matching public key in DNS. A valid signature proves the message came from you and wasn’t changed on the way.
DMARC: the instruction
Tells receivers what to do when a message claims to be from you but fails SPF and DKIM: deliver it (p=none), send it to junk (quarantine) or block it (reject). It also sends you reports.
MTA-STS: the locked door
An optional extra that makes other servers use an encrypted connection when they deliver email to you. TLS-RPT sends you a report when that fails.
Why it matters
Without DMARC, Anyone Can Email Your Clients as You
If your domain has no DMARC policy, or only p=none, a scammer can send an invoice, a “new banking details” request or a payroll change that shows your real address in the From line. Your clients and staff have no easy way to tell.
The Canadian Centre for Cyber Security says all three protocols are needed for full protection, set so receivers reject fakes. Gmail, Yahoo and Outlook.com now require SPF, DKIM and DMARC from anyone sending in bulk, and they treat unauthenticated mail with more suspicion.
Scams that use a spoofable domain
- Payroll and direct deposit changes
- Fake invoices with new banking details
- Gift card requests “from the boss”
- Password reset and “shared document” lures
Fixing a low grade
How to Get to an A Without Blocking Your Own Email
The risky part is DMARC. Switch it to reject before every real sender passes, and your own invoices or newsletters start bouncing. Go in this order.
Step 1
List every sender
Your mailbox provider, plus anything else that sends as your domain: newsletters, booking and invoicing tools, website forms, the office scanner.
Step 2
One clean SPF record
Include each sender once, stay under 10 lookups, and end with ~all.
Step 3
Turn on DKIM everywhere
Enable signing in Microsoft 365, Google Workspace or Zoho, and in each other tool that offers it.
Step 4
DMARC in stages
Start at p=none with reports, fix what fails, then move to quarantine and finally reject.
Provider guides: Microsoft 365, Google Workspace, Zoho Mail. Or let us do it as part of our email security service.
Frequently asked questions
Email Security Checker FAQs
Questions business owners ask about SPF, DKIM and DMARC.
Is this email security check really free?
Yes. There’s no sign-up and no limit. The check runs in your browser and only reads public DNS records that anyone on the internet can see.
Do you store the domain I check?
No. Your browser asks Cloudflare’s public DNS service (1.1.1.1) directly. The domain never reaches AlphaIT’s servers.
Why does DKIM say “unknown”?
DKIM keys are published under a name the provider chooses, called a selector. We try the common ones, such as selector1 for Microsoft 365 and google for Google Workspace. If yours uses a different name, enter it under “Know your DKIM selector?” and check again. An unknown DKIM result isn’t counted in the grade.
What grade should a small business aim for?
An A or a high B. That means one valid SPF record, DKIM switched on, and DMARC at quarantine or reject. MTA-STS is a bonus.
Is p=none bad?
It’s a starting point, not a finish line. With p=none you receive reports, but fake email using your domain is still delivered. Plan to move to quarantine once the reports show all your real email passing.
Can changing these records break our email?
Yes, if it’s rushed. A wrong SPF record or an early p=reject can send your own invoices and newsletters to junk or bounce them. That’s why DMARC goes in stages, with reports checked at each step.
Does a good grade stop phishing emails reaching our staff?
No. These records stop criminals from sending email as your domain. Phishing from other domains, including lookalikes like yourcornpany.ca, needs email filtering, multifactor authentication and staff training.
We don’t send email from one of our domains. Does it matter?
Yes. Unused domains are easy to spoof because nobody watches them. Publish v=spf1 -all and a DMARC p=reject record so nothing can be sent as that domain.
Free email security review
Got a C or Worse? We’ll Fix It Without Breaking Your Email
We find every service that sends as your domain, set up SPF, DKIM and DMARC, and watch the reports until it’s safe to block fakes.
780-318-0149
Edmonton, AB · serving the Edmonton region