Free email security tools

DMARC is the policy that ties SPF and DKIM back to the address your recipient actually sees, then tells receivers what to do with mail that fails. Start with the DMARC Checker to read your current record and policy, use the Generator or Setup Wizard to draft a safe rollout from p=none toward p=reject, and feed a real aggregate (RUA) report into the Report Analyser to see exactly which sources are passing and which are being spoofed. Use these before you tighten a policy, never after, because moving to enforcement blind is how legitimate mail gets blocked.

SPF lists which servers are allowed to send for your domain, and it breaks more quietly than any other record. The hard limit of ten DNS lookups counts nested includes you cannot see, so a record that looks valid can still return permerror and fail every message. The SPF Checker resolves your record the way a receiver does and counts every lookup, including the hidden ones. The SPF Generator builds a clean record from your list of senders. Run the checker whenever you add or remove a mail provider.

DKIM signs your mail with a private key and publishes the matching public key in DNS under a selector, so authentication travels with the message and survives forwarding where SPF does not. The DKIM Checker looks up a public key by selector and confirms it is valid and the right length. The DKIM Generator creates a key pair and the DNS record in your browser, so the private key never leaves your machine. Use the checker to confirm every sending platform has a working selector before you rely on DKIM for DMARC alignment.

BIMI puts your verified logo next to your name in supporting inboxes, but only once DMARC is at enforcement and your logo meets a strict SVG profile. These tools cover the whole chain. The BIMI & VMC Checker tells you whether your domain is actually eligible end to end: enforcement, record, logo and certificate. The Generator builds the record, the SVG Converter and Logo Validator check your artwork against the Tiny PS profile, and the Simulator and CMC Simulator preview how the mark renders. Use the eligibility checker first; the logo work is wasted if DMARC is not yet enforced.

These records protect mail in transit. MTA-STS, when set to enforce, tells sending servers to refuse delivery to your domain unless the connection is encrypted with a valid certificate, which closes the downgrade attacks that plain SMTP allows. TLS-RPT asks other providers to report TLS failures back to you so you can spot a problem early. DANE does the same job through DNSSEC-signed TLSA records. The MTA-STS Checker validates both the DNS record and the hosted policy file (a common point of failure), while the TLS-RPT and DANE checkers confirm the reporting and certificate-binding records resolve.

Authentication records are the cause; fraud and poor deliverability are the effects these tools measure. The Spoofing Risk Calculator estimates your exposure to spoofed-invoice fraud, and the Lookalike Domain Checker finds registered variations attackers use to impersonate you. When a suspicious message lands, the Email Header Analyser and Phishing Email Checker trace its path and flag what is wrong, while the Phishing URL Checker scores a link. On the delivery side, the Blacklist Checker, SMTP Test and Fake Email Address Checker tell you whether your mail can reach the inbox at all.

Every email-authentication record lives in DNS, so when something looks wrong the cause is often one layer down. These general-purpose lookups let you check the foundations directly. Use the DNS Record Checker, TXT Record Checker and MX Record Checker to confirm a record actually exists and resolves; the DNS Propagation Checker to see whether a change has reached resolvers worldwide; and DNSSEC, CAA, PTR and FCrDNS checkers to verify the security and reverse-DNS settings that mail receivers also weigh. The Record Splitter chunks a long TXT value into 255-character pieces so a long DKIM or flattened SPF record publishes cleanly.