SPF, DKIM and DMARC check — can someone else send email as your business?

If your domain has no SPF record and no DMARC policy, a stranger can send an invoice from accounts@yourbusiness.com.my and your customer has no way to tell. The same missing records are why your own quotations end up in the spam folder. This check reads the public DNS records and explains what they mean in business terms.

Check the email records

What we look at

• SPF — which servers are allowed to send mail as your domain, what happens to everyone else, and how many DNS lookups the record costs (the limit is ten, and a record that quietly passes it fails for everybody).
• DMARC — what your domain asks receivers to do with mail that fails the check. A policy of p=none only asks for reports: spoofing is still allowed.
• DKIM — whether a public key exists at the common selector names, so receivers can prove a message was not altered on the way.
• MX — the servers that receive your mail, in priority order, and whether a null MX says this domain deliberately accepts none.

What this check cannot claim

A real SPF verdict is computed by the receiving mail server against the IP address that sent the message. We do not have that message, so we report the shape of your record and what it implies — never "SPF passes". Likewise, a DKIM key is published under a selector only the sender knows; we can look at the thirteen common ones, and if none answer we say so instead of declaring DKIM missing.

How to read the result

Looks right: an SPF record that ends in a hard fail, a DMARC policy that rejects, at least one DKIM key, and mail servers that answer. Needs attention: monitoring-only DMARC, a soft SPF ending, or no key at the common selectors. Broken: no SPF record, more than one SPF record, or no MX at all — mail is either spoofable or not arriving.

Frequently asked

Does this read my email?

No. It reads public DNS records that anyone can look up, and nothing else. There is no mailbox access and no message content anywhere in this service.

I use Google Workspace or Microsoft 365. Is this still relevant?

Yes, and it is usually fine by default — but a domain that was migrated often keeps an old SPF record that no longer lists the right servers, and that is exactly what this check finds.

Somebody already spoofed us. What now?

Publish DMARC with p=reject after a month of reports, and make sure SPF and DKIM both align first. Doing it in the other order breaks your own outbound mail.