✉️ Email Security Checker
Is Your Email Domain Spoofable?
Check SPF, DMARC, DKIM, and MTA-STS records for any domain. Find out if attackers can send fake emails pretending to be you.
Checking domain: -
📬
SPF Record
Sender Policy Framework - specifies which mail servers can send email for this domain
Pending
▼
Enter a domain and run the check to see the SPF record.
🛡
DMARC Policy
Domain-based Message Authentication - what happens to spoofed emails (none/quarantine/reject)
Pending
▼
Enter a domain and run the check to see the DMARC policy.
🔑
DKIM Record
DomainKeys Identified Mail - cryptographic signature verifying email authenticity
Pending
▼
Enter a domain and run the check to see the DKIM record.
📭
MX Records
Mail Exchange records - shows which servers receive email for this domain
Pending
▼
Enter a domain and run the check to see the MX records.
📮
MTA-STS
Mail Transfer Agent Strict Transport Security - enforces TLS for incoming mail delivery
Pending
▼
Enter a domain and run the check to see MTA-STS status.
Why Email Security Records Matter
Without SPF, DMARC, and DKIM, anyone can send email claiming to be from your domain. This enables phishing attacks and brand impersonation.
Ideal configuration:
- SPF:
v=spf1 ... -all - DMARC:
p=reject; pct=100 - DKIM: selector + public key at _domainkey
- MTA-STS:
v=STSv1; id=...