DMARC and SPF checker: can someone send email as your domain?
Type your domain. We look up its DMARC and SPF records in public DNS and say, in plain words, whether receiving mail servers are told to reject mail forged in your name.
Free, no sign-up. We read public pages and DNS only, and keep nothing.
What it checks
- DMARC record and its policy: none, quarantine or reject
- SPF record and how it ends: -all, ~all or nothing
- Whether the domain receives mail at all (MX)
Why it matters
Without an enforcing DMARC policy, anyone can send invoices and password resets that appear to come from you. The fix is a DNS record.
A passing result means the records are published and enforce. It does not measure whether your own mail reaches inboxes.
A domain with no mail server is shown as not checked, because it does not receive mail.
This is one check. The free audit runs all of them.
Security headers, DMARC and SPF, search tags, structured data, sitemap, AI crawler access, accessibility and real-user speed, on up to 20 pages in a real browser, with a fix prompt for each finding.