Free tool
Email security check: SPF, DKIM and DMARC
Enter a domain and see whether anyone can send email pretending to be you, with an A+ to F grade and the DNS records to fix it.
We only read the domain's public DNS records. Nothing is sent to your mail servers, and results are cached for an hour.
VendorPassport re-checks your email security, headers and TLS every week and shows customers one verified security profile.
Why SPF, DKIM and DMARC matter
Email was designed without any way to prove who sent a message. Anyone can send mail that says it's from your domain, and that's how most invoice fraud and phishing in your name works. Three DNS records fix this. Together they let receiving servers check that mail claiming to be from you really is, and tell them what to do when it isn't. Gmail and Yahoo now require them for anyone sending in bulk, and many other mailboxes put unauthenticated mail in spam.
What each record does
- SPF (a TXT record on your domain) lists the servers allowed to send mail for you, and ends with what to do about the rest: -all (fail them) or ~all (mark them suspicious). Only one SPF record is allowed, and it may trigger at most 10 DNS lookups through include: and similar terms, or receivers treat it as broken.
- DKIM adds a cryptographic signature to each message. The public key lives in DNS at a selector, such as google._domainkey.example.com. Use a 2048-bit key; 1024-bit keys still work but are considered weak.
- DMARC (a TXT record at _dmarc) ties the two together. It tells receivers what to do with mail that fails both SPF and DKIM alignment: nothing (p=none), spam folder (p=quarantine) or reject (p=reject). It also asks receivers to send you daily reports through the rua address.
How the grade works
SPF is worth 30 points, DMARC 40 and DKIM 30. A DMARC policy of reject earns full marks, quarantine most of them, and none only partial credit, because a p=none policy still lets spoofed mail through. Missing reports, partial pct values, weak keys and SPF records over the lookup limit cost points. MTA-STS, TLS reporting and BIMI are shown for information. Grades use the same bands as our security headers check: A+ needs 95 or more with no failures.
A safe order to fix things
- Publish one SPF record listing every service that sends as you: your mailbox provider, plus newsletter, CRM, billing and helpdesk tools.
- Turn on DKIM in each of those services and publish their keys.
- Add DMARC with p=none and a rua address. Read the reports for a couple of weeks to find senders you forgot.
- Move to p=quarantine, then p=reject, once legitimate mail passes.
Domains that never send email need protecting too, because attackers love them. Publish v=spf1 -all and a DMARC record with p=reject on them.
Why it matters for security reviews
Bank and enterprise security questionnaires ask about SPF, DKIM and DMARC by name, and a DMARC policy of none is a common finding. Fixing it takes an afternoon and removes one of the easiest ways for someone to impersonate your company to your customers.
FAQ
Questions
Is ~all or -all better?
-all is stricter. With DMARC at quarantine or reject, ~all is also fine, because DMARC decides what happens to failing mail.
Why does it say no DKIM key was found when we sign our email?
DKIM keys live at a selector, which can be any name. Open an email you sent, find s= in the DKIM-Signature header, and enter that selector.
How long does a DNS change take to show up?
Usually minutes, but it can take up to the record's TTL, often an hour. Results here are also cached for an hour.
Will p=reject block our own mail?
Not if every service that sends as you passes SPF or DKIM with your domain. That's why you start with p=none and read the reports first.
Do you send any email to test my domain?
No. We only read public DNS records. Nothing is sent to your mail servers.
Does this check our inbox or spam rating?
No. Authentication is one part of deliverability. Reputation, content and sending volume matter too.