Free email and domain checks
Pick a tool and enter a domain. No sign-up.
Email authentication
Can someone send email as you, and does your own mail get through?
Domain spoofing test
Can someone send email as your CEO? One score, A to F, built from your SPF, DKIM and DMARC records.
Part of the spoofing test. Run one on its own for the full detail: every include, every key, the raw DNS.
SPF checker
Syntax, the 10-lookup limit many domains quietly exceed, and whether -all or ~all actually protects you.
DMARC checker
Policy, coverage and reporting, and whether p=none is leaving the door open.
DKIM checker
Probes the selectors Microsoft 365, Google Workspace and common senders use, and checks the key length.
Public data, possible errors. Every result here is built only from publicly available information: DNS records, and what a server shows to anyone who connects. It can be incomplete or wrong. DNS caching, a record changed minutes ago, split-horizon DNS, or a provider that signs and routes mail on your behalf can all make the public view differ from your real configuration. Treat a result as a starting point, not a verdict, and always have an administrator with the appropriate privileged access confirm it on the systems themselves before changing anything.
Records fixed? Now test the people.
SPF, DKIM and DMARC stop someone forging your domain. They don't stop a lookalike domain, or a colleague typing their password into one. Phishtime runs authorised phishing simulations against your own team, free for up to 25 employees.