Free tools · No account required
Email Security Health Check
See what your domain's email records say—and what still needs checking.
Check SPF, DKIM, DMARC and MX records, then take clear next steps to your IT provider. This reads public DNS; it does not send email or access your Microsoft 365 tenant.
Check your business domain
What each check tells you
SPF: authorised senders
Names the servers allowed to send for the envelope domain. We inspect the published policy and expand supported includes and redirects within a fixed budget. This is not a message-level SPF evaluation.
DKIM: signing keys
Publishes keys used to verify email signatures. A key record alone does not prove messages are being signed, that a key is valid or that the visible From domain aligns.
DMARC: handling failures
Requests how receivers handle messages that fail alignment. A monitoring policy is different from quarantine or reject. Tighten policy only after reviewing legitimate senders.
MX: receiving mail
Names the mail exchanges that receive email. Record presence does not establish delivery, encryption, filtering or account protection. A Null MX can deliberately declare no incoming mail.
Keep the wider picture in view
This is a point-in-time, bounded DNS check. DNS caching and propagation can affect the answer. We do not test mail-server connections, mailbox compromise, message signatures, MFA, provider delivery or every DKIM selector. Parent-domain DMARC inheritance, full SPF syntax and all per-message lookup paths are outside scope.
Before changing DNS, ask your mail provider to identify every sending service and test legitimate mail. A stricter record applied without that review can disrupt delivery.
Take the next step
Bring email findings into your wider security review
Start a free CyberProva assessment to review selected Microsoft 365 settings and supporting evidence. For saved website/domain checks, add a domain in your workspace and verify ownership first; scan allowances and schedules depend on your plan.