Free email security grader: Could a scammer send email as your business?
Fake invoices and "our bank details have changed" emails work because they look like they came from you. Type your domain and see in seconds how easy that is to pull off: one letter grade, plain English, and exactly what to fix. Free, no sign-up.
Rather not fix this yourself?
Your mail security records (SPF, DKIM, DMARC) are part of our free audit, along with the rest of your IT. Take the audit, decide after.
It only takes one email that looks like yours
Nobody has to break into anything. If your domain is not protected, a stranger can put your address in the From line and press send. This is what that gets used for.
The invoice your customer pays
A bill arrives from your address with someone else's account number on it. Your customer pays it, and finds out when your real invoice shows up.
The "new bank details" note
A closing, a settlement, a tax payment, a premium. One message that appears to come from your office redirects the money, and wire transfers are hard to pull back.
The request from "the owner"
Your own staff get an urgent email in your name: change a payroll deposit, send the W-2s, buy gift cards. It works because it looks like you.
Six checks, one hundred points
Email was built without any way to prove who sent a message. These records are what was added afterwards. Each one is public, so anyone can read yours, including the people deciding whose name to borrow.
SPF: 25 points
A public list of the mail systems allowed to send as you. Full marks for a record that tells everyone else to fail. None for a missing record, more than one record, or one that needs more than 10 DNS lookups to read, because past that limit it stops working.
DMARC: 35 points
The instruction that tells other mail servers what to do with email that fails your checks. It carries the most weight because it is the part that blocks anything. Reject scores full marks, quarantine a little less, monitoring only about a third.
DKIM: 20 points
A digital signature on your outgoing mail. Keys are published under names the mail provider picks, so we try the common ones. If none match, the result is marked unknown with half marks, not a fail.
MX: 10 points
Where your incoming email is delivered, and who runs it. A domain that deliberately accepts no email (a null MX) counts as valid.
MTA-STS: 5 points
Extra credit. Tells other mail servers to insist on an encrypted connection when delivering to you.
DNSSEC: 5 points
Extra credit. Signs your DNS answers so the records above cannot be swapped for forged ones on the way.
Grades: A is 90 or more, B is 80, C is 70, D is 55, and anything below that is an F.
What the grade does and does not tell you
What is email spoofing?
Sending a message with someone else's address in the From line. Nothing is broken into: the sender simply writes your address where their own should go. It is how fake invoices, changed bank details and "can you buy gift cards" requests arrive looking like they came from the owner. SPF, DKIM and DMARC are how other mail servers tell the real message from the forged one.
Does a low grade mean we have been hacked?
No. The grade measures how easy it would be to impersonate your domain, not whether anyone has. It reads public settings and looks at nothing inside your mailboxes.
Why does DKIM say "unknown"?
A DKIM key is published under a name, called a selector, that your mail provider chooses. There is no way to list them from outside, so the grader tries the common ones. If yours uses a different name the key is there and we did not find it, which is why the result is unknown and not a fail.
Can I check a domain that is not mine?
Yes. Every record the grader reads is public by design, because other mail servers have to read it too. No email is sent and nothing is logged in to.
What does the grader not check?
Anything that is not in public DNS: whether your staff use multi-factor sign-in, whether a mailbox has already been taken over, your spam filtering, and lookalike domains registered to resemble yours. A good grade closes one door. It does not mean the others are shut.
Where do the lookups go?
The checks run in your browser. It asks the public DNS services run by Cloudflare and Google for the records, and the report is built on your screen. The link you copy holds the domain name and nothing else, and it runs the checks fresh each time it is opened.
Got a grade you do not like?
Your mail security records are part of our free audit, along with the rest of your IT. Take the audit, decide after.