Skip to content
Free Security Tool

Domain Email Security Audit

We check the settings on your domain that control your email: who is allowed to send as you, whether your messages are signed, and what happens to fakes. Then we tell you, in plain English, what needs fixing.

Take the Full IT Health Check →

Takes up to half a minute. Nothing is changed on your domain. By checking you confirm you own it or are authorised to check it.

Real Threat. Right Now.

Without Email Security,
Anyone Can Be You.

An unprotected domain is an open invitation. Criminals don't need to hack your systems. They just send emails pretending to be you. Your customers, suppliers and staff have no way to tell the difference.

£2.7bn
Lost to BEC fraud globally in 2023
94%
Of malware is delivered via email
3.4bn
Phishing emails sent every day
75%
Of businesses targeted by phishing

How a spoofed email gets stopped.

Three records in your DNS, checked by every decent mail server before your name reaches an inbox.

A criminal emails your customer as you

From: [email protected]. “Our bank details have changed, please pay the attached invoice to the new account.”

No hacking needed

Your customer's mail server asks your DNS

  1. 1. SPF

    Is the sending server on your list?

    Your SPF record names the servers allowed to send as your domain. The criminal's server is not on it.

  2. 2. DKIM

    Is the signature yours?

    Genuine mail carries a signature only your systems can produce. A forgery cannot be signed.

  3. 3. DMARC

    What happens when both fail?

    Your DMARC policy tells the recipient: do nothing (none), send it to junk (quarantine) or refuse it (reject).

With DMARC set to reject

The forgery is refused. Your customer never sees it and your name stays clean.

With no DMARC, or set to none

It lands in their inbox, in your name, and the money goes to the criminal.

The free check above reads your SPF, DKIM and DMARC records and tells you which of the three steps would fail for your domain.

What the score means, and where the points come from.

  1. 100

    Fully protected

    SPF, DKIM and DMARC all present and strict. A forged email claiming to be you is rejected before anyone sees it.

  2. 50 to 99

    Partial protection

    Something is missing or soft: usually DMARC on p=none, a 1024-bit DKIM key, or SPF that is too loose. Forgeries may land in spam, or in the inbox.

  3. Under 50

    Highly vulnerable

    One or more records absent. Anyone can send email as your domain and most receiving servers will accept it.

  • SPFup to 33

    • Full: One record ending ~all, 10 or fewer DNS lookups, no stray text
    • Less: More than 10 lookups, extra text, or a hard -all: minus 10 each
    • Zero: No record, or +all / ?all: zero

  • DMARCup to 33

    • Full: p=reject at 100%
    • Less: p=quarantine at 100%: 15
    • Zero: p=none or no record: zero

  • DKIMup to 38

    • Full: 2048-bit key (34), plus 4 for strict mode
    • Less: 1024-bit key: 22
    • Zero: No record on any common selector: zero
The total is capped at 100, so a strong DKIM key gives a few points of headroom, but nothing covers a missing or soft DMARC policy. Reject is the only route to full marks.

What Attackers Do With an Unprotected Domain

💸

Invoice Fraud

Business Email Compromise

A criminal sends your customer an email from "you" with a new bank account. The customer pays. You never see the money.

🎣

Phishing Your Staff

Internal Phishing

Employees receive emails appearing to come from HR or IT asking for login credentials or urgent bank transfers.

🏢

CEO Impersonation

Whaling Attack

Criminals pose as the company director, urgently requesting wire transfers or sensitive data from finance teams.

📉

Brand Damage

Reputation Destruction

Thousands of spam or scam emails sent from your domain get you blacklisted. Your real emails stop reaching inboxes.

The good news: SPF, DKIM, and DMARC stop all of this.

When all three records are correctly configured, receiving mail servers can verify that emails claiming to be from your domain are actually from you, and reject anything that isn't. It's the single most impactful email security change any business can make.

How Each Record Protects You

SPF, DKIM and DMARC work as a team. Each plays a distinct role and all three are needed for complete protection.

SPF

Think of SPF as your business's guest list. It tells the world exactly which servers are allowed to send emails on your behalf.

DMARC

DMARC is the bouncer. It looks at the results from the guest list (SPF) and the wax seal (DKIM) and decides whether to reject or deliver.

DKIM

DKIM is like a wax seal on a physical letter. It attaches a cryptographic signature to every email so servers know it wasn't tampered with.

Get Your Email Security Fixed Today
Go Deeper

Email security is just the start.

Our full IT Health Check dives deep into your entire technology environment, helping you uncover and reduce the unknown risks that could put your business at risk.

Take the Full IT Health Check

Free · No commitment · Takes 5 minutes