Email security check
Can someone send email that looks like it came from you? Type your domain to see your SPF, DKIM and DMARC setup, a grade, and what to fix.
Results
SPF, DKIM and DMARC in plain English
Email was built without a way to prove who sent a message. Anyone can type your address into the From line. Three DNS records fix that, and receiving servers check all three before they decide whether to trust a message.
SPF: who may send for you
SPF is a list of the servers and services allowed to send email for your domain, such as Microsoft 365, Google Workspace or your newsletter tool. It ends with a rule for everyone else: -all means fail, ~all means treat with suspicion. SPF checks the hidden return address, not the From address people see, and it can trigger no more than 10 DNS lookups. Past that, receivers treat it as an error.
DKIM: a signature on every message
DKIM adds a digital signature to each email you send. The matching public key sits in your DNS under a name called a selector. If someone changes the message on the way, or a server that doesn't hold your key tries to sign for you, the signature fails.
DMARC: what to do when checks fail
DMARC ties SPF and DKIM to the From address people actually see. It passes only when SPF or DKIM passes for that same domain. Then it tells receivers what to do with email that fails: p=none (deliver it and send me a report), p=quarantine (send it to spam) or p=reject (refuse it). The rua tag asks for daily reports, so you can see every service sending as your domain, including the ones you forgot about.
Why this matters more since 2024
Since February 2024, Google and Yahoo require everyone sending to their users to set up SPF or DKIM. Bulk senders, which Google defines as anyone sending close to 5,000 or more messages a day to personal Gmail accounts, must have SPF, DKIM and a DMARC record, with the From domain aligned. Microsoft added similar rules for high-volume senders to Outlook.com in May 2025. The minimum DMARC policy for these rules is p=none, but p=none doesn't stop spoofing. Only quarantine or reject does.
If your grade is low, the fix is usually a few DNS changes made in the right order. Our email security service handles this as part of a wider plan against phishing.
Questions about the email check
Does this check send my domain to GlobeVM?
No. The check runs in your browser and asks public DNS services (Cloudflare, with Google as a backup) for your domain's records. Nothing is stored or sent to GlobeVM. Those DNS services see the lookups, as they would for any DNS query.
Why does it say DKIM wasn't found when I have DKIM set up?
DNS can't list every DKIM key a domain has, so we test the most common selector names. If your provider uses a custom one, we won't see it. To find yours, open the full headers of an email you sent and look for s= in the DKIM-Signature line.
Is a DMARC policy of p=none enough?
No. p=none only collects reports; it doesn't stop anyone sending email as your domain. It's the right first step. Once your reports show that every real service you use passes, move to p=quarantine and then p=reject.
How often should I run this check?
Whenever you change email providers or add a service that sends email for you, such as a newsletter, CRM or invoicing tool. Each one needs to be covered by SPF or DKIM, or its email may start failing DMARC.
Want us to fix this?
Get a free IT assessment. We look at your setup and give you a plain-English list of what to fix first. No cost and no obligation.