Email Security Scanner

Free Email Security Scanner: Check Your SPF, DKIM & DMARC Records Instantly

Your domain might be sending emails right now — and anyone on the internet could be sending emails pretending to be you. Without properly configured email authentication records, there is nothing stopping an attacker from spoofing your domain, impersonating your employees, and tricking your clients into handing over sensitive data.

SPF, DKIM, and DMARC are three DNS-based email authentication protocols that work together to verify that an email actually came from your domain and hasn’t been tampered with in transit. When all three are configured correctly, receiving mail servers can confidently reject forged messages before they ever reach an inbox.

Our free email security scanner checks all three records in seconds with zero signups, zero data collection, and zero cost.

What Does This Email Security Scanner Check?

This tool performs a real-time DNS lookup against your domain and analyzes three critical email authentication records. It scores your domain from 0 to 100, flags misconfigurations, and gives you specific recommendations to fix any issues it finds.

SPF (Sender Policy Framework)

SPF tells the world which mail servers are authorized to send email on behalf of your domain. It works by publishing a TXT record in your DNS that lists approved IP addresses and services. When a receiving server gets an email claiming to be from your domain, it checks your SPF record to see if the sending server is on the approved list.

The scanner checks whether your SPF record exists, whether it uses a strict or permissive policy, and whether you are exceeding the 10 DNS lookup limit that can cause SPF to silently fail.

Common SPF problems the scanner detects:

• No SPF record published at all
• Multiple SPF records (causes automatic failure per RFC 7208)
• Using +all which allows any server in the world to send as your domain
• Using ~all (softfail) instead of the stricter -all
• Exceeding the 10 DNS lookup limit with too many include statements

DKIM (DomainKeys Identified Mail)

DKIM adds a cryptographic signature to every outgoing email. The sending server signs the message with a private key, and publishes the corresponding public key in DNS. The receiving server uses that public key to verify the signature, confirming the message hasn’t been altered in transit and really originated from your domain.

The scanner checks 13 commonly used DKIM selectors including those used by Google Workspace, Microsoft 365, Mailchimp, and Mandrill. If your domain uses a custom selector not in this list, the tool will let you know.

Common DKIM issues the scanner identifies:

• No DKIM record found for any common selector
• DKIM record exists but public key is empty or revoked
• Selector misconfiguration preventing signature validation

DMARC (Domain-based Message Authentication, Reporting and Conformance)

DMARC ties SPF and DKIM together and tells receiving servers what to do when an email fails authentication. Without DMARC, a server might still deliver a spoofed email even if SPF and DKIM checks fail. DMARC lets you set a policy — none, quarantine, or reject — that instructs servers on how to handle unauthenticated messages.

The scanner evaluates your DMARC policy strength, checks whether you have aggregate reporting configured, and flags any gaps that leave your domain exposed.

Common DMARC problems the scanner catches:

• No DMARC record published
• Policy set to “none” which monitors but takes no enforcement action
• Policy set to “quarantine” instead of the stronger “reject”
• No aggregate report (rua) address configured, meaning you receive no visibility into who is sending email as your domain

Why Email Authentication Matters

Email remains the number one attack vector for cybercriminals. According to the FBI’s Internet Crime Complaint Center, business email compromise (BEC) attacks accounted for over $2.9 billion in losses in a single year. The majority of these attacks rely on domain spoofing — sending emails that appear to come from a trusted domain but actually originate from an attacker-controlled server.

Without SPF, DKIM, and DMARC working together, your domain is essentially an open door for attackers to walk through.

Brand Protection

When an attacker spoofs your domain and sends phishing emails to your customers, clients, or partners, the damage falls on your reputation. Even if you had nothing to do with the attack, the recipient sees your domain in the From field. Proper email authentication prevents this by ensuring forged messages are rejected before delivery.

Deliverability

Google and Yahoo both began enforcing DMARC requirements for bulk senders in 2024. If your domain does not have valid SPF, DKIM, and DMARC records, your legitimate emails are increasingly likely to land in spam folders or be rejected entirely. Email authentication is no longer optional for inbox placement.

Compliance

Industries with regulatory requirements — including banking, healthcare, government, and legal — increasingly require email authentication as part of their security controls. NIST, PCI DSS, and HIPAA-related guidance all reference email security as a fundamental protection for sensitive communications.

Visibility

DMARC reporting gives you unprecedented visibility into your email ecosystem. When properly configured with an aggregate report address, you receive daily reports showing every server that sent email using your domain. This allows you to identify unauthorized senders, detect spoofing attempts, and verify that your legitimate email services are properly authenticated.

How to Fix Common Email Security Issues

Setting Up SPF

If the scanner shows no SPF record or a weak policy, you need to add or update a TXT record in your DNS. A basic SPF record looks like this:

v=spf1 include:_spf.google.com include:spf.protection.outlook.com -all

This example authorizes Google Workspace and Microsoft 365 to send email for your domain, and tells all other servers to reject messages. Replace the include statements with whichever email services you actually use.

Keep your SPF record under the 10 DNS lookup limit by consolidating includes and removing services you no longer use.

Setting Up DKIM

DKIM configuration depends on your email provider. Most major providers — Google Workspace, Microsoft 365, Mailchimp, SendGrid — have built-in DKIM signing that you activate by adding a CNAME or TXT record to your DNS. Check your email provider’s documentation for the specific record they require.

The key step most administrators miss is actually enabling DKIM signing in the provider’s admin console after adding the DNS record. The DNS record publishes the public key, but the provider must also be configured to sign outgoing messages with the corresponding private key.

Setting Up DMARC

Start with a monitoring policy to understand your email landscape before enforcing:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com;

This tells receiving servers to send you aggregate reports without blocking any messages. Monitor these reports for 2 to 4 weeks to identify all legitimate senders, then progressively tighten your policy from none to quarantine to reject.

A fully enforced DMARC record looks like:

v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourdomain.com; ruf=mailto:dmarc-forensics@yourdomain.com;

How the Scanner Works

This tool uses Google’s public DNS-over-HTTPS API to query your domain’s TXT records in real time. Everything runs in your browser — no data is sent to our servers, no information is stored, and no account is required.

When you enter a domain, the scanner performs three lookups: your root domain TXT records for SPF, 13 common DKIM selector subdomains, and the _dmarc subdomain for your DMARC policy. It then parses each record, evaluates it against best practices, and generates a composite score with specific recommendations.

Who Should Use This Tool

Small business owners who want to verify their domain is not being spoofed and their emails are reaching customers.

IT administrators managing email infrastructure who need a quick verification tool during setup or troubleshooting.

Managed service providers assessing client email security posture during onboarding or audits.

Cybersecurity professionals performing reconnaissance or security assessments as part of penetration testing or risk evaluations.

Marketing teams experiencing deliverability issues who need to verify their sending domain authentication is correctly configured.

Frequently Asked Questions

Is this tool free?

Yes. The email security scanner is completely free with no signup, no account creation, and no usage limits. Run as many scans as you need.

Does this tool store my domain or results?

No. All lookups happen in your browser using Google’s public DNS API. Nothing is transmitted to or stored on our servers.

Why does my DKIM show as not found?

DKIM records are published under a specific selector subdomain. This tool checks 13 common selectors used by major email providers. If your organization uses a custom selector, the tool may not find it. Check your email provider’s admin console for the exact selector name.

What score should I aim for?

A score of 100 means SPF, DKIM, and DMARC are all properly configured with strict enforcement policies. Anything below 80 indicates meaningful gaps that should be addressed. Any domain scoring below 50 has critical vulnerabilities that leave it wide open to spoofing.

Can I scan any domain?

Yes. Since this tool queries publicly available DNS records, you can scan any domain to check its email authentication posture. This is the same information any email server in the world can access.

I found issues — can you help me fix them?

Absolutely. Forestal Security specializes in email security configuration for businesses. We can properly configure SPF, DKIM, and DMARC for your domain, set up aggregate reporting, and monitor your results to ensure full protection. Contact us for a free assessment.

Protect Your Domain Today

Email spoofing is not a theoretical risk. It is happening right now to domains that lack proper authentication. Run a scan above to see where your domain stands, and take action on any issues the tool identifies.

If you need help configuring your email security records or want a comprehensive email security assessment, reach out to Forestal Security — we help businesses protect their communications with properly configured authentication, monitoring, and ongoing management.