What this email security checker looks at
Every email claims to be from someone, but email itself has no built-in proof of who sent it. Three public DNS records let receiving servers check that claim:
- SPF (Sender Policy Framework) lists the services allowed to send email for your domain, such as Microsoft 365 or your website’s mail service.
- DKIM (DomainKeys Identified Mail) adds a digital signature to each message, so a receiving server can confirm it really came from you and wasn’t changed on the way.
- DMARC tells receiving servers what to do with email that fails those checks: nothing (none), send it to spam (quarantine) or block it (reject). It can also send you reports about who is sending email as you.
This email security checker also shows which email provider you use, based on your MX records, and names the services your SPF record allows to send for you.
The domain health checkup
Below your email grade, the checker looks at the domain itself:
- Registration and renewal: who your registrar is, when the domain was first registered and when it expires. An expired domain takes your website and email down with it.
- Transfer lock: whether your domain is locked against being moved to another registrar without your approval.
- DNS hosting: who hosts your DNS, and that you have at least two nameservers.
- DNSSEC: whether your DNS records are signed against forgery (optional).
- Website security: whether your site loads securely over HTTPS, with and without www.
- Certificate rules (CAA): whether you limit which companies may issue security certificates for your domain (optional).
- Advanced email extras: MTA-STS, TLS reporting and BIMI (optional, not part of the grade).
What your grade means
| Grade | What it means |
|---|---|
| A | SPF is correct, DKIM is found and DMARC is set to reject. Fake email that claims to be from you is blocked. |
| B | SPF and DMARC are in place, and fakes should land in spam. Usually one step away from an A. |
| C | DMARC is set to monitoring only (p=none). You can see spoofing in reports, but fakes still reach inboxes. |
| D | Something important is missing or broken: no DMARC, or no working SPF record. |
| F | No SPF and no DMARC, or an SPF record that lets anyone in the world send as you. |
Why it matters for a small business
The email scams that cost small businesses the most usually aren’t viruses. They’re a fake invoice, or a “we’ve changed our bank details” message, that looks like it came from you or from someone your staff trusts. When your domain grades an A, receiving servers block email that uses your exact domain without permission.
An A doesn’t stop every scam. Criminals can still register lookalike domains or break into a real mailbox. But it closes the easiest door, and it protects your customers and vendors from fakes sent in your name.
How we fix it without breaking your email
Jumping straight to “reject” can block your own real email if a service that sends for you, like your website, invoicing software or newsletter tool, isn’t set up first. We do it in steps:
- List every service that sends email as you.
- Fix SPF and turn on DKIM for each one.
- Start DMARC with reporting turned on, and read the reports to catch anything we missed.
- Move to quarantine, then to reject.
We followed the same steps for our own domain, sohologics.com, which grades an A.
Want us to get your domain to an A?
Frequently asked questions
Is this checker really free?
Yes. There’s no sign-up, no email address required and no limit on how many domains you check.
Do you store the domains I check?
No. The checker runs in your browser. It looks up public DNS records through Cloudflare’s or Google’s public DNS service, looks up public registration details at rdap.org, and checks whether the domain’s website loads. The domain you enter isn’t sent to or stored by sohologics.com, unless you choose “Email me this report.” Then we keep your email address, the domain and its grade so we can send the report and, only if you tick the box, follow up once.
Can I get the results by email?
Yes. Click “Email me this report” under your results and we’ll send a branded copy of your report, with a link back to the full live results. You can also click “Download PDF report” to save it yourself, no email needed.
Can I check someone else’s domain?
Yes. SPF, DKIM and DMARC records are public by design, so anyone can look them up. It’s a quick way to see whether a vendor or partner is protected before you trust an email about payments.
Why does it say DKIM wasn’t found when I know it’s set up?
DKIM records live under a name your email provider chooses (a “selector”), and there’s no way to list them all. We check the most common ones, including the ones Microsoft 365 and Google Workspace use. If yours uses a custom name, the checker can’t see it, so a missing DKIM result never counts as a failure on its own.
Will setting DMARC to reject block my real email?
It can, if a service that sends email for you isn’t set up with SPF or DKIM first. That’s why we start with monitoring and reports, fix every sender, and only then tighten the policy.
Does an A mean I’m safe from email scams?
No single setting makes you safe. An A means nobody can easily send email using your exact domain. Scammers can still use lookalike domains or a hacked mailbox, which is why we pair this with multi-factor authentication, email filtering and staff training.
Why does my domain need a transfer lock?
The lock stops anyone from moving your domain to another registrar without your approval. Pair it with multi-factor authentication on your registrar account, and make sure that account is in your company’s name, not a former employee’s or web designer’s.
How long does it take to fix?
The DNS changes themselves take minutes. The careful part is confirming every service that sends as you, which usually means watching DMARC reports for a week or two before moving to reject.
I use Microsoft 365. Isn’t this set up automatically?
Partly. Microsoft 365 needs an SPF record and two DKIM records added to your DNS, plus DKIM switched on in the admin center. DMARC isn’t set up for you at all.
