>_ Tools / Email Security Checker
Email Security Checker
Enter your company domain to see whether scammers can send email that looks like it came from you. Checks SPF, DKIM and DMARC.
FreeNo sign-up
>_ What it checks
>_ Guide
Why this matters
Without SPF, DKIM and DMARC, anyone can send an email that shows [email protected] as the sender. Scammers use this to send fake invoices with new bank account details to your customers and suppliers. This is called business email compromise (BEC).
What each record does
- SPF is a TXT record listing the servers allowed to send your email, for example Google Workspace or Microsoft 365. End it with
-allonce you are sure the list is complete. - DKIM adds a signature to every email. Turn it on in your email provider's admin panel and publish the key it gives you.
- DMARC tells other servers what to do when SPF and DKIM fail. Start with
p=noneand a report address, then move toquarantineand finallyreject.
A safe order to roll it out
| Step | Record | Example |
|---|---|---|
| 1 | SPF | v=spf1 include:_spf.google.com ~all |
| 2 | DKIM | Enable in Google Workspace or Microsoft 365 and add the TXT record |
| 3 | DMARC monitor | v=DMARC1; p=none; rua=mailto:[email protected] |
| 4 | DMARC enforce | p=quarantine, then p=reject after a few weeks of clean reports |
Google and Yahoo now require SPF, DKIM and DMARC from anyone who sends bulk email, so missing records also push your own legitimate email into spam.
>_ FAQ
Frequently asked questions
What is a good DMARC policy?
p=reject is the strongest. Most companies start with p=none to collect reports, then move to quarantine and reject once all their legitimate senders pass.
Why is DKIM not found when I have it enabled?
DKIM keys live under a selector name that only your email provider knows. We test common selectors such as google, selector1 and default. If yours uses another name, it can still be set up correctly.
Does this tool send an email?
No. It only reads public DNS records for the domain.
Is ~all or -all better for SPF?
-all (hard fail) is stricter. ~all (soft fail) is common and safe while you are still finding every service that sends email for you. With DMARC at quarantine or reject, either works.
>_ Mission control
Spoofed invoices cost real money.
Business email compromise is one of the costliest scams for Malaysian companies. RC.MY runs phishing simulations and email security reviews.
>_ Tools
More free tools
Every tool is free, needs no sign-up, and is built by the RC.MY penetration testing team.
Also on RC.MY Surah Al-Mulk · Surah Yasin · Surah Al-Waqiah · Surah Al-Fatihah · Surah Al-Kahf · Surah Ar-Rahman · Ayat Kursi · Ayat 1000 Dinar · Doa harian