Free tool

Email security checker

If your email authentication is missing or too relaxed, anyone can send messages that look like they come from you. Customers and staff are far more likely to trust those messages. This checker reads your public SPF, DKIM and DMARC settings and tells you what to change.

What this checks

SPF: presence, syntax, duplicate records, overly broad endings, DNS lookups counted through every include (limit 10), stale includes
DKIM: keys at commonly used selectors plus selectors you enter, key type and size, revoked and test-mode keys
DMARC: presence, policy (none, quarantine, reject), subdomain policy, pct, reporting addresses and their authorization
MX: mail servers, provider (only when certain), null MX, servers that do not resolve
Optional hardening: MTA-STS, TLS-RPT and BIMI (recommendations only)
An Email Security Score, plain-English findings and a safe fix for each

How to use it

Run the check and read the score and the biggest risks.
Start with DMARC and SPF findings; copy the suggested record into your DNS provider.
Move DMARC gradually: monitor (p=none), review senders, fix SPF and DKIM, quarantine with a small percentage, then reject last.
Rescan to verify.

Methodology and limitations

DKIM selectors cannot be listed from DNS, so without a selector the result is “not verified”, never “missing”. Enter your selector to verify it. PixelPrivate performs passive checks against publicly visible configuration only. It does not test for exploitable vulnerabilities, so a clean result is not a guarantee of security. Read the full security methodology.

Key terms

DMARC — DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS record that tells receiving mail servers what to do with email that claims to be from your domain but fails SPF and DKIM checks..
SPF — SPF (Sender Policy Framework) is a DNS TXT record that lists the servers allowed to send email on behalf of your domain..
DKIM — DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to outgoing email so receivers can verify it came from your domain and was not altered in transit..
Domain spoofing — Domain spoofing is sending email that forges your exact domain in the From address, without having access to your email accounts..

Frequently asked questions

Do I need DMARC if I only send a few emails?

Yes. Criminals do not need you to send much; they only need your domain name. DMARC also helps your real mail reach inboxes.

Will p=reject block my own email?

Only if a legitimate sender is not covered by SPF or DKIM. That is why you monitor reports under p=none first.

Monitor this domain continuously with PixelPrivate.

Create a free account to re-check automatically, keep your DKIM selectors, and get alerted when SPF, DKIM, DMARC or MX records change.

Create free account