Free email check

Check a domain's SPF, DKIM and DMARC yourself, free

Every record is public. Four lookups from any terminal show what a domain publishes; this page says what each answer means and gives the fix for anything missing. Our own domain's records are on the security page, read live.

The lookups

Put the domain in place of yourfirm.co.uk. From a Mac or Linux terminal:

dig +short MX yourfirm.co.uk
dig +short TXT yourfirm.co.uk
dig +short TXT _dmarc.yourfirm.co.uk
dig +short TXT selector1._domainkey.yourfirm.co.uk

From Windows PowerShell:

(Resolve-DnsName yourfirm.co.uk -Type MX).NameExchange
(Resolve-DnsName yourfirm.co.uk -Type TXT).Strings
(Resolve-DnsName _dmarc.yourfirm.co.uk -Type TXT).Strings
(Resolve-DnsName selector1._domainkey.yourfirm.co.uk -Type TXT).Strings

What the lookups read

MX: which servers take the domain's email, and so who runs it (Microsoft 365, Google Workspace or another).
SPF: the TXT record at the domain beginning v=spf1, which lists the servers allowed to send as it.
DMARC: the TXT record at _dmarc, which tells receivers what to do with a message that fails the other checks.
DKIM: a key under a selector the sender chooses, which lets a receiver check a message was signed by the domain. Microsoft 365 uses selector1 and selector2; Google uses google.

Reading the results

No SPF record

Any server can claim to send for the domain, and receivers have nothing to check it against. The fix: One SPF record for the domain's mail provider, ending ~all: include:spf.protection.outlook.com for Microsoft 365, include:_spf.google.com for Google Workspace. Anything else that sends as the domain goes into the same record. A domain that publishes no mail servers gets v=spf1 -all.

No DMARC record

Receivers are never told to turn fakes away, and the domain gets no reports of mail sent in its name. The fix: Publish v=DMARC1; p=none with a reporting address somebody reads, read the reports for 4 to 8 weeks, then move to p=quarantine and then p=reject.

DMARC set to p=none

The record exists, but it only watches. The fix: The record the business publishes with one change: p=none becomes p=quarantine (pct=25 only where a pct is already set), keeping where the reports go and every other tag. Where the record sends its reports nowhere, the first step is a reporting address, at p=none.

Why p=none protects nothing yet, and the safe order to tighten it: our plain English guide.

DKIM not found

Not proof of a problem: the domain may sign under a selector you did not try. Check with the mail provider.

How UK businesses are doing

Of the 33,579 businesses we have read in 26 cities that run their own email, 24,924 (74%) publish no enforced DMARC policy. Each city's count and the dates of its reads are in the city reports. No business is named.

Questions

Is the check free?

Yes. No account, and nothing to install. The lookups read public records only, the same ones any mail server reads when your email arrives.

What does DMARC p=none mean?

It means the domain monitors and asks nothing. A receiving server is told what to do with a message that fails the checks, and p=none tells it to do nothing. Fakes in the domain's name are left to each server's own judgement.

Why does Bondstone say DKIM was not found rather than missing?

A DKIM key sits under a name the sender chooses (a selector), and there is no way to list them. We try the 16 most common when we read a domain. If none answers, the domain may still sign its mail under a name we did not try, so we never call DKIM missing.

Does DMARC stop lookalike domains?

No. It protects the exact domain only. It does not stop firmname-uk.com, and it does not stop someone who has got into a real mailbox.

I run IT support. Can I check my clients?

Yes, one domain at a time with the lookups on this page. For the hundred businesses near your office with a problem you can fix, each with its record and the fix, see the Evidence Pack.

For IT support firms and MSPs

These lookups check one domain. Bondstone reads every office business near your office the same way and hands you the hundred you can help most, each with the record and the fix. See the Evidence Pack, or count your area for free.