Free tool
Can someone send email as your business?
A DMARC, SPF and DKIM checker that explains itself. Type your domain. In a second you get a plain answer: wide open, half protected, or protected, and what each record is doing.
Questions people ask
What does this check actually look at?
Three public records on your domain: SPF, which lists who is allowed to send email as you; DKIM, which puts a signature on every genuine email; and DMARC, which tells receiving inboxes what to do with anything that fails. It also reads where your email is hosted. All of it is public DNS, the same thing every inbox in the world checks when your email arrives.
Can someone really send email as my business?
If DMARC is missing or set to none, yes. They do not need your password. They send an email with your address in the From line, and most inboxes deliver it. The common frauds are a fake invoice with new bank details, or a message to your customers asking them to pay a deposit.
Does this cost anything to fix?
No. All three records are free settings at your email provider and your domain company. Google Workspace and Microsoft 365 both have a one-screen DKIM setup. The DMARC record is one line of text. The only cost is twenty minutes, or a message to whoever runs your email.
Why does it say DKIM was not found when my provider says it is on?
DKIM keys are published under a name your provider chooses. This tool tries the common ones. If yours uses an unusual name, the key exists but the tool cannot see it. Your provider's own DKIM page will confirm it either way.
Does Sydex keep my domain or the results?
No. The check runs, the result is shown to you, and nothing is written down. The only thing that leaves your browser is the domain name you typed, sent to our checker to read the records.