Free tool · Email · DNS
Free DMARC and SPF checker: can someone send email as you?
Without SPF and an enforced DMARC policy, anyone can send email that appears to come from your domain. It is the starting point of most phishing campaigns against your customers and staff.
A DMARC and SPF checker reads your domain’s DNS records to see whether email spoofing is blocked. SPF lists the servers allowed to send for your domain, DKIM signs messages, and DMARC tells receiving servers to quarantine or reject email that fails those checks. A DMARC policy of p=none monitors but does not stop spoofing.
How to read the results
| Record | Weak | Strong |
|---|---|---|
| SPF | Missing, or ending in +all or ?all | Lists your senders and ends in -all or ~all |
| DMARC | Missing, or p=none | p=quarantine or p=reject, with reporting |
| DNSSEC | Not signed | Signed and validated |
| Zone transfer | AXFR allowed to anyone | Refused to unknown hosts |
| Dangling records | CNAMEs pointing at deleted cloud resources | Removed when the resource is removed |
Frequently asked questions
What is a good DMARC policy?
Start with p=none and reporting to find all your legitimate senders, then move to p=quarantine and p=reject.
Do I need both SPF and DMARC?
Yes. DMARC relies on SPF and DKIM results; without DMARC, receivers decide on their own what to do with failures.
Can a dangling DNS record be dangerous?
Yes. A CNAME pointing at a deleted cloud resource can let someone else claim it and serve content on your subdomain.
More free tools
Want to know who would fall for a phish?
Sumrite’s phishing simulations measure clicks, credential entry and reporting by team.