Free email domain check
Can someone send email in your company’s name?
Enter the domain you use for email. In a few seconds you see whether forged messages are blocked, what is missing to block them, and which lookalike domains have already been registered.
We read public DNS records only. No email is sent and nothing touches your systems.
- Result straight away, no sign-up
- SPF, DKIM, DMARC and lookalike domains
- Report you can print to PDF
Keep an eye on it, free
Check your inbox
Rather have us do it?
Leave a contact: we reply with a proposal to secure your domain.
After you send it, the lookalike domain names become visible in the report.
Request received
We will reply to the address you gave.
The lookalike domain names are now visible in the report above.
What we check
DMARC
The policy that tells receiving servers what to do with mail that uses your domain without authorisation. Until it is enforced, that mail is delivered.
SPF
The list of servers allowed to send your mail. We verify that it is valid, stays within the limits of the standard and authorises no more than necessary.
DKIM
The signature that makes your mail tamper-proof. We look for the published keys and flag those that are weak, revoked or never switched on.
Lookalike domains
Variants of your domain — one character off, another extension — that someone has already registered, and whether they can receive mail.
Transport
MTA-STS, TLS-RPT, DNSSEC and BIMI: protection for mail in transit and for the integrity of your records.
Why now
Since 5 May 2025 Outlook.com rejects mail from high-volume senders that lacks SPF, DKIM and DMARC. Gmail and Yahoo have applied similar requirements since February 2024.
Source: Microsoft, Google
In 2025 the FBI recorded 24,768 complaints of business email compromise (BEC), with losses above 3 billion dollars.
Source: FBI, IC3 Annual Report 2025
In an analysis of 693 Italian domains published in 2025, 26% had no DMARC record at all and only 16.7% applied the strictest policy.
In May 2026 DMARC entered the IETF standards track with RFC 9989, which replaces the 2015 specification.
Source: IETF, RFC 9989
From check to protection
The check shows where you are exposed. Getting to a policy that actually blocks forged mail, without losing legitimate mail, takes three steps.
1
Check
Free
This page: the state of the domain, the issues in order of severity and the registered lookalike domains.
2
Remediation
Fixed price
We inventory every system that sends mail in your name — mailboxes, CRM, newsletters, ERP, ticketing — and bring each one to authenticate. Then we raise DMARC in stages, up to reject.
- SPF corrected and within the limits of the standard
- DKIM enabled on every sending service
- DMARC taken to reject, checking the reports at each stage
- Lock-down of domains that send no mail
3
Monitoring
Free for one domain
We re-check the domain every week and write to you only when something changes. The paid plan adds more domains, a daily check and the watch on lookalike domains.
- Changes to SPF, DKIM, DMARC and mail servers
- Fix plan, one step at a time
- Lookalike domains that appear or start handling mail (paid plan)
Frequently asked questions
Is this a penetration test? Do I need authorisation?
No. The check reads public DNS records, the same ones every mail server consults when it receives a message from you. It sends no messages, does not connect to your servers and tries no credentials.
I already have SPF. Isn’t that enough?
No. SPF verifies the sending server against a technical address the recipient never sees. The address shown in the From field is protected only by DMARC, which requires SPF or DKIM to pass with your own domain.
Why not set p=reject straight away?
Because receivers would also reject legitimate mail sent by systems that are not yet authenticated: newsletters, invoices from the ERP, CRM notifications. First you watch the reports, fix each sender, then raise the policy.
What are lookalike domains, and what can I do about them?
They are domains almost identical to yours, registered by someone else. DMARC does not stop them, because technically they are different domains. They can be watched, blocked at your own mail gateway and, where the imitation is clear, disputed.
What data do you keep?
The domain that was scanned and what it publishes in DNS, which is public data. Your email address only if you start monitoring or fill in the form: we use it to sign you in, for the alerts you asked for and to reply to you. You can delete the account at any time from its page.
Is the fix plan written by an AI?
The steps, their order, the DNS records and the waiting times are worked out by our scan engine. On request, a language model rewrites the instructions for your mail and DNS providers: it receives only public DNS data about the domain, never your contact details, and every record, address or host name it proposes is checked by the engine before it is shown.