Instant PDF download · 14-day money-back guarantee · Secure checkout with Stripe
Nova PrintablesPrintables · Planners · Puzzles

Shop › Website security check

SPF and DMARC checker

SPF and DMARC records tell inboxes which email really comes from your domain. See your site's security grade in about 20 seconds: HTTPS and certificate, security headers, cookie flags, version leaks, mixed content, and whether scammers can send email as your domain (SPF and DMARC).

Passive and read-only: we load your homepage like a browser and read public DNS records. Nothing is attacked or stored beyond your result.

What you get

  • Free: your grade and every finding in plain English.
  • Fix-It Report: exact steps for your platform (Cloudflare, WordPress, Apache, Nginx, Netlify, Vercel, Squarespace, Wix, Shopify) and DNS records ready to paste.

Not a penetration test: it checks your public configuration, not your software's code or passwords.

Why it matters

Without SPF and DMARC, anyone can send email that appears to come from your domain: fake invoices, password resets or payment requests to your customers. Gmail and Yahoo now require bulk senders to have SPF, DKIM and DMARC, and they filter mail from domains without them more aggressively.

What SPF does

An SPF record is a DNS TXT record that lists which services may send email for your domain, such as Google Workspace or Microsoft 365. Mail from anywhere else fails the check.

What DMARC does

A DMARC record tells receiving servers what to do when a message fails SPF and DKIM (nothing, quarantine or reject) and sends you reports. Start at p=none, read the reports, then move to quarantine and reject.

Questions

I don't send email from my domain. Do I still need SPF?

Yes. A record of v=spf1 -all says no server may send for your domain, which blocks spoofing outright.

Will changing DNS break my email?

SPF must include every service that sends for you; DMARC at p=none only reports and doesn't block. The Fix-It Report gives the exact records for common providers.

Is this check safe to run?

Yes. It reads public DNS records and loads your homepage like a normal browser. Nothing is probed or attacked.

More free tools: Debt snowball calculator · Debt avalanche calculator · Credit card payoff calculator · 50/30/20 budget calculator · Emergency fund calculator · Security headers checker · Website security check · Debt payoff planner · Budget planner