Free Domain Security Scan

This scan is a starting point for visibility and review.

• DMARC record visibility
• SPF and DKIM readiness
• Email authentication gaps
• Domain spoofing risk indicators
• Sender source review starting point

• It does not guarantee phishing prevention
• It does not stop all spoofing by itself
• It does not show whether your real mail passes DMARC. That takes report monitoring
• It does not replace mailbox security
• It does not certify compliance
• It does not replace a full security review

How to read your results

Most scans return three findings that matter. Here is what each one actually means for your domain.

How a message passes DMARC

A message passes DMARC when either SPF or DKIM passes and the domain that passed aligns with the domain in the visible From address. It does not need both. Having both set up still matters, because forwarding and mailing lists often break SPF while a DKIM signature survives. This scan reads the records you publish in DNS. It cannot see whether your real mail is passing or how receivers are treating it; DMARC aggregate reports show that.

Your DMARC policy: none, quarantine, or reject

DMARC (Domain-based Message Authentication, Reporting, and Conformance) tells receiving mail servers what to do with a message that fails authentication. A policy of p=none means "do nothing, just report", which is the right place to start but offers no protection on its own. p=quarantine sends failures to spam. p=reject asks receivers to refuse them outright and is the strongest instruction you can publish against mail sent as your exact domain. Receivers decide how to honor it, and no DMARC policy covers lookalike domains or a compromised mailbox. Many firms set p=none years ago and never moved past it, which means the record exists but the enforcement does not.

SPF softfail versus hardfail

SPF (Sender Policy Framework) lists the servers allowed to send for your domain. A record ending in ~all is a softfail: mail from an unlisted server is accepted but marked. Ending in -all is a hardfail and is stricter. Softfail is a reasonable staging point, but leaving it there indefinitely weakens the whole chain. Watch the lookup limit too: SPF allows ten DNS lookups, and practices that have accumulated several senders often exceed it, which silently invalidates the record.

A missing DKIM selector

DKIM (DomainKeys Identified Mail) signs your outbound mail with a key published in DNS under a named selector. A scan can only check the selectors it knows to look for, so "no DKIM found" sometimes means the selector is non-standard rather than absent. It is worth confirming directly in Microsoft 365 or Google Workspace before assuming DKIM is missing. If it genuinely is not enabled, your mail depends on SPF alone to pass DMARC, and anything that breaks SPF (forwarding, a mailing list, an over-limit record) fails outright. Enable DKIM before moving to enforcement.

The order matters: get SPF and DKIM correct first, watch the DMARC reports, then move the policy to quarantine and finally reject. Skipping to reject with an incomplete SPF record is how firms accidentally block their own invoices. See email and DMARC security services for how we run that sequence.