Free Email Security Check - SPF, DKIM and DMARC

Email was designed in an era when nobody imagined it would carry invoices, payroll changes, and bank details. Out of the box, nothing verifies that a message claiming to be from your domain actually came from you; anyone with a laptop can put your address in the From field. SPF, DKIM and DMARC are three DNS records that close that gap, and they only work when they are set up together.

SPF (Sender Policy Framework) is a public list of the servers allowed to send email for your domain: your mail provider, your accounting software, your newsletter tool. When a message arrives claiming to be from you, the receiving server checks the sending server against that list. No SPF record means there is no list to check.

DKIM (DomainKeys Identified Mail) adds a digital signature to every message you send. The receiving server verifies the signature against a public key published in your DNS, proving the message genuinely left your systems and was not altered on the way. It survives forwarding, which SPF often does not.

DMARC is the record that does the enforcing. It tells receiving servers what to do with a message that fails SPF and DKIM: p=none means "just report it to me", so spoofed mail is still delivered. p=quarantine sends failures to spam, and p=reject blocks them outright. Without DMARC, SPF and DKIM are opinions the receiving server is free to ignore; with an enforced policy, they become rules.

The scam this stops is depressingly common: a criminal sends your client (or your own accounts team) an email that looks exactly like it came from your director, with "updated bank details" for the next invoice. The money goes to the scammer's account, and by the time anyone rings to ask why the invoice was not paid, it is gone. Scamwatch calls this payment redirection fraud, and it costs Australian businesses tens of millions of dollars every year. Small businesses are hit hardest because these three records so often sit unconfigured on their domains.

A spoofed email needs none of your passwords and no access to your systems, just a domain with no enforcement. If your check above shows a missing DMARC record or a p=none policy, anyone can send email as your domain today and most of it will land in inboxes, not spam. The reverse matters too: Microsoft and Google now demand proper authentication from senders, so gaps in these records quietly push your own legitimate quotes and invoices into junk folders.