Know your email grade before an attacker does.
We check your SPF, DKIM and DMARC records and give your domain one A+ to F grade, with the fixes listed in priority order. We also check BIMI.
acme.example, one grade for the whole domain
Read, grade, fix.
Run it free on any domain, or keep it checked continuously on Professional and above.
-
Read
We read your domain's SPF, DMARC and DKIM records and your mail (MX) records. DKIM is probed across 12+ common selectors.
SPF Pass Hard fail, within the lookup limitDMARC Monitoring Policy: noneDKIM Found Signing found -
Grade
The records combine into one A+ to F grade for the domain. There is one grade, not a letter for each protocol.
acme.example B One grade for the domain -
Fix
Each gap comes with the fix, listed in priority order, so you know what to change first.
Move DMARC from none to quarantine or reject First Spoofed mail isn't being blocked yetAdd DMARC aggregate reporting Next See who sends as your domain
Read
We read your domain's SPF, DMARC and DKIM records and your mail (MX) records. DKIM is probed across 12+ common selectors.
Grade
The records combine into one A+ to F grade for the domain. There is one grade, not a letter for each protocol.
Fix
Each gap comes with the fix, listed in priority order, so you know what to change first.
What's checked, and what isn't.
Every claim on this page has a limit. These are the limits.
| Area | Covered | Not covered |
|---|---|---|
| One grade | SPF, DKIM, DMARC and your mail records combine into one A+ to F grade, with the fixes listed in priority order. | A separate letter for each protocol. |
| SPF | We check that a record exists and flag records likely to break the 10-lookup limit. | Following every include to the end of the chain. |
| DMARC | We read the policy (none, quarantine or reject) and whether reporting is set up, because monitor-only is visibility, not protection. | Reading your DMARC reports or checking that your mail passes alignment. |
| DKIM | We probe 12+ selectors that major mail and gateway providers use, and look for a signing key. | Every selector, or a gap in a second provider's signing. We stop once we find one. |
| Mail provider | We recognise major mail providers and gateways, so a domain on a major provider that uses custom DKIM selectors isn't marked as unsigned. | Scoring against each provider's own conventions. The same rules apply to every domain. |
| BIMI | We check whether your logo record is published and your certificate is reachable. BIMI needs DMARC at quarantine or reject, so that is when we look. It is reported separately from the grade. | Validating the certificate. We check that it can be reached, not that it is valid. |
One grade
- Covered
- SPF, DKIM, DMARC and your mail records combine into one A+ to F grade, with the fixes listed in priority order.
- Not covered
- A separate letter for each protocol.
SPF
- Covered
- We check that a record exists and flag records likely to break the 10-lookup limit.
- Not covered
- Following every include to the end of the chain.
DMARC
- Covered
- We read the policy (none, quarantine or reject) and whether reporting is set up, because monitor-only is visibility, not protection.
- Not covered
- Reading your DMARC reports or checking that your mail passes alignment.
DKIM
- Covered
- We probe 12+ selectors that major mail and gateway providers use, and look for a signing key.
- Not covered
- Every selector, or a gap in a second provider's signing. We stop once we find one.
Mail provider
- Covered
- We recognise major mail providers and gateways, so a domain on a major provider that uses custom DKIM selectors isn't marked as unsigned.
- Not covered
- Scoring against each provider's own conventions. The same rules apply to every domain.
BIMI
- Covered
- We check whether your logo record is published and your certificate is reachable. BIMI needs DMARC at quarantine or reject, so that is when we look. It is reported separately from the grade.
- Not covered
- Validating the certificate. We check that it can be reached, not that it is valid.
Your email posture is one of the signals.
We look at lookalikes, impersonation accounts, app listings, leak-site mentions, certificates and your email authentication together, and rate the situation as one.
Where spoofing and impersonation meet
Find out what your email grade is.
Run a free domain scan, no signup. It shows exactly this grade for your domain, and the checks behind it. Or book a demo and we'll walk through the fixes.