What this free checker tells you
Type your business domain (the part after the @ in your email address) and, in about a minute, you get plain-English answers to two questions:
- Could someone impersonate your company’s email? We check three public email-security records and give you a grade from A to F.
- Could your business lose access to its domain? We check when your domain’s registration expires (when the registry shows it), whether it is locked against being moved, and whether your DNS hosting and website certificate look healthy.
Technical details are available under each answer, for you or your IT person. There is nothing to install and no sign-in.
How email impersonation is checked (SPF, DKIM and DMARC)
Every email claims to be from someone, but email itself has no built-in proof of who sent it. Three public DNS records let receiving servers check that claim:
- SPF (Sender Policy Framework) lists the services allowed to send email for your domain, such as Microsoft 365 or your website’s mail service.
- DKIM (DomainKeys Identified Mail) adds a digital signature to each message, so a receiving server can confirm it really came from you and wasn’t changed on the way.
- DMARC tells receiving servers what to do with email that fails those checks: nothing (none), send it to spam (quarantine) or block it (reject). It can also send you reports about who is sending email as you.
This email security checker also shows which email provider you use, based on your MX records, and names the services your SPF record allows to send for you.
The domain health checkup
Below your email results, the checker looks at the domain itself:
- Registration and renewal: who your registrar is, when the domain was first registered and when it expires. An expired domain takes your website and email down with it. We can’t see your registrar account, so we can’t tell whether auto-renew is turned on.
- Transfer lock: whether your domain is locked against being moved to another registrar without your approval.
- DNS hosting: who hosts your DNS, and that you have at least two nameservers.
- Optional extras: DNSSEC, certificate rules (CAA), and email extras such as MTA-STS, TLS reporting and BIMI. These don’t affect your grade.
What your grade means
The grade covers your email protection only (SPF, DKIM and DMARC). Domain health is shown separately, so a perfect email grade never hides a domain that is about to expire.
| Grade | What it means |
|---|---|
| A | SPF is correct, DKIM is found and DMARC is set to reject. Fake email that claims to be from you is blocked. |
| B | SPF and DMARC are in place, and fakes should land in spam. Usually one step away from an A. |
| C | DMARC is set to monitoring only (p=none). You can see spoofing in reports, but fakes still reach inboxes. |
| D | Something important is missing or broken: no DMARC, or no working SPF record. |
| F | No SPF and no DMARC, or an SPF record that lets anyone in the world send as you. |
Why it matters for a small business
The email scams that cost small businesses the most usually aren’t viruses. They’re a fake invoice, or a “we’ve changed our bank details” message, that looks like it came from you or from someone your staff trusts. When your domain grades an A, receiving servers block email that uses your exact domain without permission.
An A doesn’t stop every scam. Criminals can still register lookalike domains or break into a real mailbox. But it closes the easiest door, and it protects your customers and vendors from fakes sent in your name.
How we fix it without breaking your email
Jumping straight to “reject” can block your own real email if a service that sends for you, like your website, invoicing software or newsletter tool, isn’t set up first. We do it in steps:
- List every service that sends email as you.
- Fix SPF and turn on DKIM for each one.
- Start DMARC with reporting turned on, and read the reports to catch anything we missed.
- Move to quarantine, then to reject.
We followed the same steps for our own domain, sohologics.com, which grades an A.
Want a second opinion on your results?
Free, over Microsoft Teams, no obligation.
Frequently asked questions
Is this checker really free?
Yes. There’s no sign-up, no email address required and no limit on how many domains you check.
Do you store the domains I check?
No. The checker runs in your browser. It looks up public DNS records through Cloudflare’s or Google’s public DNS service, looks up public registration details, and checks whether the domain’s website loads. The domain you enter isn’t sent to or stored by sohologics.com, unless you choose “Email me this report” or “Start Free Monitoring.” Then we keep your email address and the domain (and, for a report, its grade) so we can send what you asked for.
Can I get the results by email?
Yes. Click “Email me this report” under your results and we’ll send a branded copy of your report, with a link back to the full live results. You can also click “Download PDF report” to save it yourself, no email needed.
What does the free monitoring do?
After you verify your email address, we re-check your domain every day. We email you if we detect a problem, a change, or an approaching expiry (for the domain or its website certificate), plus a short monthly status email with a few recent articles from our blog. The email address must be at the domain you’re watching. You can stop any time with the link in every email.
Can the checker tell me if my domain will renew automatically?
No. We read the public registration record, which shows when the domain expires but not your registrar’s billing or auto-renew settings. Check that auto-renew is on and that the card on file hasn’t expired.
What if the checker can’t read my domain’s expiry date?
A few country-code domain endings don’t publish registration details, so the checker says it couldn’t verify them instead of guessing. Check the renewal date in your registrar account.
Can I check someone else’s domain?
Yes. SPF, DKIM and DMARC records are public by design, so anyone can look them up. It’s a quick way to see whether a vendor or partner is protected before you trust an email about payments.
Why does it say DKIM wasn’t found when I know it’s set up?
DKIM records live under a name your email provider chooses (a “selector”), and there’s no way to list them all. We check the most common ones, including the ones Microsoft 365 and Google Workspace use. If yours uses a custom name, the checker can’t see it, so a missing DKIM result never counts as a failure on its own.
Will setting DMARC to reject block my real email?
It can, if a service that sends email for you isn’t set up with SPF or DKIM first. That’s why we start with monitoring and reports, fix every sender, and only then tighten the policy.
Does an A mean I’m safe from email scams?
No single setting makes you safe. An A means nobody can easily send email using your exact domain. Scammers can still use lookalike domains or a hacked mailbox, which is why we pair this with multi-factor authentication, email filtering and staff training.
Why does my domain need a transfer lock?
The lock stops anyone from moving your domain to another registrar without your approval. Pair it with multi-factor authentication on your registrar account, and make sure that account is in your company’s name, not a former employee’s or web designer’s.
How long does it take to fix?
The DNS changes themselves take minutes. The careful part is confirming every service that sends as you, which usually means watching DMARC reports for a week or two before moving to reject.
I use Microsoft 365. Isn’t this set up automatically?
Partly. Microsoft 365 needs an SPF record and two DKIM records added to your DNS, plus DKIM switched on in the admin center. DMARC isn’t set up for you at all.
