Check your email security:
Are SPF, DKIM and DMARC set up correctly?
If these records don’t work together properly, strangers can send emails in your name – and your own messages end up in spam more often.
No setup needed – your business email address is all it takes to run the check.
SPF, DKIM and DMARC check at a glance
Grade A to F for mail security
No setup
Results in 24 h
Your domain won’t show you that its DNS records are misconfigured
SPF, DKIM or DMARC have often been sitting on a setting for years that nobody has checked since.
What does the CheckFix email check test?
The email check reads the DNS records of your domain that determine security and deliverability: SPF, DKIM and DMARC. It tells you whether the records are present, valid and set strictly enough – and assigns a grade from A to F.
The check runs purely externally, using only publicly visible data – with no agents on your servers.
The email check is part of the free Security Check from CheckFix.
✓ Free✓ SPF, DKIM & DMARC✓ No setup✓ Grade A–F
What the check reads in detail
Only what is publicly reachable via your domain is checked – exactly the view an attacker has.
SPF check
Is this server allowed to send for your domain? The check reads your SPF record and reports if it is missing, set too loosely, duplicated or contradictory.
DKIM check
Are your emails signed? The check verifies whether DKIM is set up for your domain so that recipients can verify your emails as genuine.
DMARC check
Is a policy in force? The check looks at whether a DMARC policy is set (none, quarantine or reject) and whether an address for reports is on file.
Transport encryption
STARTTLS: The check also sees whether your mail server accepts incoming connections in encrypted form. The in-depth check of the TLS configuration is done by Gossling.
What misconfigured records can do
Spoofing & Phishing
Without a clean SPF/DKIM/DMARC chain, any stranger can send emails in the name of your domain that pass as genuine with the recipient – invoices, payment requests, instructions in the name of management.
Deliverability
If the records are missing or faulty, Google, Microsoft and others downgrade your genuine emails. They end up in spam or are rejected.
Compliance
Mail security is a common audit point in NIS2 and ISO 27001 environments. The check provides evidence that the records are in place.
Emails checked - are there other important cybersecurity topics?
The email check shows you that something is wrong with your mail settings and rates it with a grade.
However, it is only one part of the free CheckFix Security Check, which checks your entire external attack surface in one run – mail security (SPF, DKIM, DMARC), TLS/SSL, known vulnerabilities (CVE matching), security headers and internet-facing interfaces – with a grade from A to F per category.
If security gaps are found, you unlock a to-do list with all technical details. With it, your own trusted technician closes the gaps in a targeted way – without five-figure consulting costs.
And how do you set the records up correctly? Step by step in our guide: Configuring DNS Records for Email the Right Way.
Frequently Asked Questions
How do I run an SPF check?
Enter your domain, start the check: CheckFix reads your SPF record from the DNS and reports whether it is missing, set too loosely or appears more than once. The result feeds into the grade for mail security – free of charge.
How do I run a DKIM check?
Enter your domain, start the check: CheckFix checks whether DKIM is set up for your domain so that recipients can recognise your emails as genuine. The result feeds into the grade for mail security – free of charge.
How do I run a DMARC check?
CheckFix reads your DMARC record and shows which policy is in force (none, quarantine, reject) and whether a report address is on file. This shows you whether the policy really protects you or merely observes.
Do I need to check all domains or only the ones I actually send emails from?
All domains, not just the ones you actively send from. An attacker does not need access to your domain to enter it as the sender. Only SPF and DMARC tell recipients that no genuine emails come from this domain. That is why website-only and parked domains need protecting too. How to set the records for this is explained in the DNS guide.
What does it mean if SPF, DKIM or DMARC are missing?
Then your domain is easier to misuse for spoofing, and your genuine emails are classified as spam more often. Only the three together provide reliable protection – how to set them is explained in the DNS guide.
Is SPF alone enough?
No. SPF defines which servers may send, but it does not check the sender your recipients see, nor anything about the authenticity of the content. DKIM takes care of that, and DMARC combines both into an enforceable policy.
Do I need DMARC for NIS2?
NIS2 does not name a specific DNS method, but it does require appropriate technical measures and structured risk management. A clean SPF/DKIM/DMARC chain is part of the state of the art and is a verifiable checkpoint in an audit.