Business Email Security Check
Find out in seconds whether someone can send email pretending to be your company. Enter your domain and this checks the public records that decide it — SPF, DKIM, DMARC and more — then explains what each one means in plain English.
What this check looks at
Three DNS records decide whether your domain can be impersonated, and almost every small business has at least one of them wrong or missing. They work together, and each one answers a different question.
| Record | What it answers | What happens without it |
|---|---|---|
| SPF | Which servers are allowed to send email using your domain name. | Receiving systems have no list to check a sender against, so a forgery looks the same as the real thing. |
| DKIM | Was this message genuinely sent by your mail system, and has it been altered on the way? | Messages carry no cryptographic proof of origin, and forwarded legitimate mail is more likely to fail checks. |
| DMARC | What should a receiver actually do when a message claiming to be from you fails the checks above? | Nothing happens. This is the record that turns SPF and DKIM from information into protection. |
The check also looks at MTA-STS and TLS-RPT, which govern whether mail sent to you must travel over an encrypted connection, and DNSSEC, which signs your DNS answers so they cannot be forged in transit. Those three are worthwhile hardening rather than urgent gaps, and the results page says so rather than inflating them into emergencies.
Can someone really send email pretending to be my business?
Yes, and it is easier than most owners expect. The From address on an email is not verified by the protocol itself — it is simply text that the sender writes. Anyone can put your company's domain in it. The only thing that stops a forgery being delivered is a published policy telling receiving mail systems to reject messages that fail authentication.
That policy is DMARC, and it is the record most commonly missing. A domain with a perfectly good SPF record and working DKIM signing, but no DMARC policy, is still impersonable. Receivers can tell the message failed. They just have not been told to care.
The damage from this is rarely dramatic. It is usually an invoice that appears to come from you with different bank details, a request to a supplier that looks like it came from your owner's address, or a customer who receives something offensive apparently from your company. By the time you find out, the recipient has already acted on it.
Why are my emails going to junk?
This is the other question that brings people to a business email security check, and the honest answer is that authentication is part of the picture but not all of it. If your domain fails SPF and has no DKIM signature, you are starting every delivery from a position of suspicion, and fixing that genuinely helps.
But content, sending volume, complaint rates, list quality and the reputation of the IP address you send from all matter too. Anyone who promises that publishing three DNS records will guarantee inbox placement is overselling. What these records do is remove a reason for receivers to distrust you — a necessary step, not a complete solution.
What SPF, DKIM and DMARC do not do
They do not reduce the spam arriving in your inbox. This is the single most common misunderstanding, and it is worth being clear about because it changes what you should do next.
SPF, DKIM and DMARC are all about mail sent using your domain. They protect the people who receive email from you. Filtering what arrives in your own mailboxes is a completely separate job, handled by anti-spam and anti-phishing settings inside Microsoft 365, Google Workspace, or whatever hosts your mail. If your actual complaint is the volume of junk you personally receive, this check will not fix it, and we would rather tell you that now than after you have paid someone.
They also do not stop look-alike domains. If an attacker registers yourcompany-invoices.com and sends from that, your DMARC policy has no say — it only governs your own domain. Nor do they help if someone's mailbox password is stolen and mail is sent from inside your real account, which is how most small businesses are actually compromised.
A note on how this check works
Everything happens in your browser. When you enter a domain, your own browser queries Cloudflare's and Google's public DNS resolvers over an encrypted connection and reads the published records. The domain you type is never sent to StashGrid, no account is created, and no result is stored. You can open your browser's Network tab and watch exactly what is requested.
That also means the check is limited to what is public. It cannot see inside your Microsoft 365 or Google Workspace tenant, so it says nothing about your mailbox security settings, multi-factor authentication, admin accounts or forwarding rules. Those need authorised access and are a different kind of review entirely.
One limitation is worth stating plainly, because other tools gloss over it. DKIM keys cannot be enumerated from DNS. A key is published under a name called a selector, and there is no way to ask a domain which selectors it uses. This tool tries the selectors used by the major mail platforms. If your domain uses a custom one, the result will say no key was found at the selectors checked — not that DKIM is missing — and those points are excluded from your score rather than counted against you.
Frequently asked questions
Can someone send email pretending to be my business?
If your domain has no DMARC policy set to quarantine or reject, then yes. Anyone can put your domain in the From address and most receiving systems have no instruction telling them to stop it. SPF and DKIM alone do not prevent this — DMARC is the part that tells receivers what to do when those checks fail.
Do SPF, DKIM and DMARC stop the spam I receive?
No. They govern email sent using your domain name and protect the people who receive mail from you. Reducing junk arriving in your own inbox is a separate matter, handled by filtering settings inside your mail platform.
Is my data stored when I run this check?
No. The check runs entirely in your browser using public DNS lookups through Cloudflare and Google's public resolvers. The domain you type is never sent to StashGrid, no account is required, and nothing is saved.
Why does it say DKIM could not be verified?
DKIM keys live under a selector name, and DNS provides no way to list which selectors exist. We try the selectors used by the common platforms. A domain using a custom selector shows as unverified even though DKIM is working — which is why we say no key was found at the selectors checked, and exclude those points from the score.
What does a DMARC policy of p=none mean?
It means DMARC is watching but not acting. Receivers report on failures but deliver the mail anyway. It is the right place to start, because it lets you find legitimate senders before blocking anything — but a domain left at p=none is not protected from impersonation.
What is the SPF 10-lookup limit?
SPF evaluation is capped at ten DNS queries. Each include, a, mx, ptr, exists and redirect entry costs at least one, and services chain to more behind the scenes. Over the limit, receivers return a permanent error and your SPF record stops working entirely — even though it looks perfectly normal.