Free tool No signup Plain English

Is your domain protected
from email spoofing?

Enter a domain or email and we’ll check your DMARC, SPF, and DKIM records — then explain what they mean in plain English.

Public DNS only
No spam, no store
Check your domain

We only look up public DNS records. We don’t store your domain or send you spam.

DMARC SPF DKIM
Plain English. No jargon.
THE BASICS

How email authentication works

DMARC doesn't work alone. It builds on SPF and DKIM to tell inbox providers what to do when something looks wrong.

1

SPF — who's allowed to send

SPF is a list in your DNS of mail servers permitted to send email for your domain. If someone sends from a server not on that list, receivers may flag or reject it.

Think of it as a guest list for your domain's outbound mail.

2

DKIM — proof it wasn't tampered with

DKIM adds a digital signature to outgoing mail. Receiving servers verify it against a public key in your DNS — confirming the message wasn't altered in transit.

Like a wax seal on a letter.

3

DMARC — what to do when checks fail

DMARC tells inbox providers what to do with mail that fails SPF or DKIM: monitor (none), quarantine, or reject. It also tells them where to send reports about who's sending as you.

It's the bouncer checking the guest list and wax seal.

WHY IT MATTERS

Anyone can spoof your domain

Without DMARC, SPF, and DKIM, attackers can impersonate your company — and major inbox providers are tightening authentication requirements. See what a realistic spoofed email looks like in Outlook.

View spoof email preview

Who's sending email on your behalf?

Most businesses have more senders than they realize. Every service that sends as your domain needs to be in your SPF record and signing with DKIM.

Common authorized senders
  • • Microsoft 365 / Google Workspace (day-to-day email)
  • • Mailchimp, HubSpot, Constant Contact (marketing)
  • • SendGrid, Mailgun, Amazon SES (transactional)
  • • Zendesk, Freshdesk, Shopify (notifications)
Signs something's wrong
  • • Legitimate mail landing in recipients' spam
  • • Customers reporting phishing from your domain
  • • DMARC reports showing unknown senders
  • • No DMARC record at all
NEED A HAND?

Want us to put the records in place?

The checker shows what’s missing. If you want it handled, Network26 does the standard single-domain setup: review, publish, and 30 days of watching.

Have us set this up Call 425-368-9526 ← Back to Network26.com