Free Tool · Naples & SW Florida
Email Security Check.
SPF, DKIM & DMARC
in about 15 seconds.
Run a free email security check on your business domain. We check your SPF record, DKIM signing, DMARC policy and MX records, grade the setup from A to F, and tell you in plain English what to fix so your email reaches the inbox and scammers can't pose as your company.
Email Security Check
Check SPF, DKIM & DMARC.
See exactly what to fix.
Type your domain or any email address at it. The tool works as an SPF record check, DKIM checker, DMARC checker and MX lookup in one: it reads your public DNS records, gives you a grade, and shows a one-line fix for anything that needs attention. Nothing is installed and no test email is sent.
What SPF, DKIM and DMARC do
SPF (Sender Policy Framework) is a DNS record that lists the servers allowed to send email for your domain. DKIM (DomainKeys Identified Mail) adds a digital signature to each message so receivers can confirm it really came from you and wasn't changed on the way. DMARC ties the two together: it tells Gmail, Outlook and other receivers what to do with mail that fails, and sends you reports about who is sending email in your name.
Your MX records are the fourth piece: they tell the world where to deliver your email. The checker also looks at extras like MTA-STS, TLS reporting, BIMI and DNSSEC. They are nice to have, so they are shown for information and are not part of the grade.
Why email authentication matters now
Since 2024, Google and Yahoo have required bulk senders to authenticate their mail with SPF, DKIM and DMARC, and Microsoft has announced similar rules for Outlook.com. Even if you only send everyday business email, mailbox providers are quicker to send unauthenticated mail to spam or reject it. Missing records also make it easier for criminals to send email that looks like it came from you, which is how many business email compromise and fake-invoice scams start.
How to read your grade
A means SPF, DKIM and DMARC are in place with an enforced DMARC policy. B and C usually mean DMARC is still at p=none (monitoring only), reporting is missing, or DKIM wasn't found on a common selector. D and F mean SPF or DMARC is missing or broken, so spoofing is easy and deliverability suffers. Each row shows what we found, why it matters and how to fix it, and you can open the raw DNS records at the bottom of the results.
How FLTECHS sets it up with Microsoft 365
Most of the businesses we support run email on Microsoft 365. We publish a single SPF record that covers every service that sends mail as you, turn on DKIM signing in Microsoft 365, and start DMARC at p=none with reporting. Once the reports show your real mail passing, we move the policy to quarantine and then reject, so spoofed mail gets blocked without cutting off your own messages.
We do this as part of our Microsoft 365 services and our cybersecurity services for businesses in Naples, Fort Myers and Miami-Dade.
Is this email security check safe?
Yes. It only reads public DNS records, the same information any mail server looks up when you send it a message. It runs in your browser, doesn't log in to anything, doesn't send test emails, and FLTECHS doesn't store the domains you check.
What if DKIM isn't found?
DKIM keys are published under a name called a selector, and selectors can't be listed from the outside. So the checker tests the most common ones, like selector1 and selector2 for Microsoft 365 and google for Google Workspace. If none match, DKIM may still be set up under a custom name. Check your email provider's admin console, or send us your results and we'll confirm.
How long do DNS changes take?
Most DNS changes show up within minutes to a few hours, depending on the record's TTL (time to live). With some DNS providers it can take up to 48 hours. Run the check again after you make a change; it looks up fresh answers every time.
Do I need DMARC set to reject?
p=reject gives the strongest protection against spoofing, and p=quarantine is a solid step on the way. Start at p=none with reporting, make sure every service that sends mail as you (your mailboxes, website forms, invoicing and marketing tools) passes SPF or DKIM, then tighten the policy. Jumping straight to reject without checking can block your own legitimate email.
When to call an IT partner
If you got a D or F, have several services sending email as you, or aren't sure who manages your DNS, it's worth getting help. FLTECHS sets up and monitors email authentication for small businesses in Naples, Fort Myers and Miami-Dade, in English and Spanish. Call 239-986-8647 or get a free consult.