Email Security Checker
Can attackers send email that looks like it’s from your domain? Check your SPF, DMARC and DKIM in seconds and get a plain-English grade with fixes.
Runs entirely in your browser via public DNS. Nothing is stored, no email required.
SPF, DMARC & DKIM, explained
What does this email security checker do?
It looks up your domain’s SPF, DMARC and DKIM DNS records and grades how well they protect you against email spoofing and phishing. SPF says which servers may send mail as your domain, DMARC tells receivers what to do with mail that fails, and DKIM cryptographically signs your mail so it can’t be tampered with. The check runs in your browser against public DNS — nothing is stored and no email address is required.
What is a good DMARC policy?
DMARC has three enforcement levels: p=none (monitor only — spoofed mail is still delivered), p=quarantine (spoofed mail goes to spam), and p=reject (spoofed mail is rejected outright). p=reject is the strongest and the recommended end state. Many domains start at p=none to collect reports, then tighten to quarantine and reject once legitimate senders are verified.
What does “~all” vs “-all” mean in SPF?
“-all” (hard fail) tells receivers to reject mail from servers not listed in your SPF record — the recommended setting. “~all” (soft fail) marks such mail as suspicious but still delivers it, so spoofing is not actually blocked. If your record ends in ~all, tighten it to -all once you’ve confirmed every legitimate sending service is listed.
Why does email spoofing matter for compliance?
Spoofable domains are a direct phishing and business-email-compromise risk, and email authentication shows up across SOC 2, ISO 27001 and general security-posture reviews. It’s also one of the first things attackers and security-rating vendors check. CATAAM’s attack-surface management flags SPF/DMARC weaknesses automatically alongside exposed services, TLS and security headers.
Is this the same as CATAAM’s attack surface scan?
This is the email-security slice, run instantly and without signup. CATAAM’s full attack-surface scan also covers exposed services, open ports, TLS/SSL configuration, security headers and more, and gives you a Fragility score benchmarked against 1,171 organizations. Run the full scan to see your whole external footprint.