SPF - who’s allowed to send
Lists the mail servers permitted to send on your behalf. Missing or too broad, and forged mail sails through.
Free tool · no signup
Can someone send email pretending to be you?
Check your domain’s SPF, DKIM, DMARC and MTA-STS records in seconds. If they’re missing or misconfigured, spammers and phishers can send email that looks like it came from you - and your customers pay the price.
Reads public DNS only · nothing installed · instant result
DKIM - proof it’s really you
A cryptographic signature receivers verify against your public key, so a message can’t be altered or faked in transit.
DMARC - the enforcement policy
Tells inboxes to reject or quarantine anything that fails. A policy of p=none protects nobody.
Email authentication, explained
- What is DMARC, and why does it matter?
- DMARC tells receiving mail servers what to do with email that fails your SPF and DKIM checks - the difference between a spoofed message being rejected and it landing in a customer’s inbox. Without a DMARC policy of “quarantine” or “reject”, anyone can send email that appears to come from your domain.
- What’s the difference between SPF, DKIM and DMARC?
- SPF lists the servers allowed to send mail for your domain. DKIM cryptographically signs your messages so they can’t be tampered with. DMARC ties the two together and sets the enforcement policy. You need all three to be properly protected.
- Is this check safe to run on any domain?
- Yes. Everything here is read from public DNS - the same records any mail server reads when it receives a message from you. Nothing is sent, nothing is installed, and no email is delivered.
- How do I fix the issues you find?
- Each finding includes the specific record to add or change at your DNS provider. Email authentication is a set-and-forget fix - but it can silently break during a provider migration, which is exactly what WebZoo’s continuous monitoring catches.
Watch it, don’t just check it once.
Email auth breaks quietly during migrations. WebZoo tells you when.