PTS Managed Services · Free tool · Nothing stored
Can criminals send email as your company?
Check any domain's SPF, DKIM and DMARC in seconds: the three DNS records that decide whether the internet trusts mail claiming to come from you. Live checks, plain-English findings, and exactly what to fix.
Email me the full report, and the fixes
Get this report in your inbox with a prioritised fix list for your mail platform. A PTS engineer reviews every submission; where the fix is a morning's work, we'll say so.
What this checker tests
Email fraud almost always starts with a message that looks like it comes from a real company: an invoice with new bank details, a CEO asking for an urgent transfer, a supplier "updating" payment records. Three public DNS records decide whether receivers can tell your real mail from those forgeries. This tool reads them live, exactly as Gmail or Microsoft 365 does, and grades what it finds out of 100.
SPF: who may send as you
A TXT record listing the servers authorised to send your mail. The checker verifies it exists, that there's exactly one, that it ends with a meaningful policy (~all or -all), and, the part most tools skip, it resolves every nested include: to count DNS lookups, because SPF silently breaks past the limit of 10. Years of adding marketing and helpdesk tools is how good domains quietly go over.
DKIM: proof mail is really yours
A cryptographic signature on every outgoing message, verified against a public key in your DNS. Keys live under named selectors that can't be listed from outside, so the checker probes the selectors used by Microsoft 365, Google Workspace and the major sending services, and lets you enter a custom one. It also grades key strength: 1024-bit keys are deprecated; 2048-bit is the standard.
DMARC: what receivers do about failures
The policy record that makes SPF and DKIM matter. The checker reads your policy on the ladder from p=none (detect, deliver anyway) through quarantine to reject, whether the rollout percentage has reached 100, whether aggregate reporting is switched on, and whether subdomains are left as a side door.
It also identifies your mail platform from your MX records (so the advice can say "here's where this lives in Microsoft 365" rather than pointing at a manual) and notes the extra-credit records, MTA-STS and BIMI.
Why it matters in Hong Kong
Payment-redirection fraud (the fake invoice, the "urgent" transfer, the supplier whose bank details changed) remains one of the most common and expensive attacks on Hong Kong businesses, and a domain without enforced DMARC is its ideal disguise. Getting to p=reject doesn't stop every scam, but it takes your exact domain out of the criminal's toolkit, and it's usually a day of configuration, not a project.
From this grade to p=reject
- SPF repaired and flattened under the 10-lookup limit, with every legitimate sender accounted for
- DKIM enabled and rotated to 2048-bit on Microsoft 365, Google Workspace or your platform
- DMARC rolled out safely: reporting first, then quarantine, then reject, without losing real mail
- Delivered as part of Microsoft 365 security and managed cybersecurity
Common questions
Is it safe to check my domain here?
Yes. The checker reads your domain's public DNS records: the same information every mail server on the internet already sees when it receives a message from you. The lookups run from your own browser via encrypted DNS (dns.google / Cloudflare), nothing touches your mail system, and we don't store the domains checked.
What do SPF, DKIM and DMARC actually do?
SPF lists the servers allowed to send email as your domain. DKIM puts a cryptographic signature on your outgoing mail so receivers can verify it wasn't forged or altered. DMARC is the policy that ties them together: it tells receivers what to do when a message fails (deliver, junk, or reject) and sends you reports about who is sending as your domain. You need all three; any one alone leaves the door open.
Why is DMARC p=none a problem?
p=none means 'check my mail, then deliver it anyway'. It's the correct starting point while you gather reports, but many businesses stay there for years, which means receivers detect spoofed mail claiming to be you and still put it in the inbox. The ladder is none → quarantine → reject, and reject is where fake-invoice fraud dies.
What is the SPF 10-lookup limit?
Receivers resolve at most 10 DNS lookups when evaluating your SPF record. Every include:, a, mx, exists and redirect counts, including the ones nested inside your providers' own records. Go over 10 and SPF returns a permanent error, silently switching your protection off. It's one of the most common invisible breakages, usually caused by accumulating marketing and helpdesk tools over the years.
What is a DKIM selector, and why didn't you find my key?
A selector is the label your provider files its signing key under in DNS (Microsoft 365 uses selector1/selector2, Google uses google, and so on). Selectors can't be listed from outside, so this tool probes the common ones. If your provider uses a custom selector, type it into the selector field and re-check, or check your mail platform's DKIM settings page for the name.
Does this work for Microsoft 365 and Google Workspace?
Yes. Both publish standard SPF includes and well-known DKIM selectors, and the checker recognises the platform from your MX records so the advice matches your setup. Note that on Microsoft 365, DKIM for custom domains often ships disabled until someone turns it on (a very common finding).
My grade is low. What do I actually do?
Every finding on this page is fixable in DNS and your mail platform's admin console, usually within a day: publish or repair SPF, enable DKIM signing, then introduce DMARC at p=none with reporting, tighten to quarantine, and finish at p=reject once the reports are clean. PTS does this end-to-end as part of email security; the 'email me the report' button below sends us your results so we can quote the fix.
Does a good grade mean I can't be phished?
It means criminals can't send mail as your exact domain to mainstream receivers, which kills the most convincing fraud. They can still register look-alike domains or compromise a real mailbox, which is why authentication sits alongside filtering, MFA and staff training rather than replacing them.
The checker reads public DNS records via encrypted DNS from your browser; results reflect DNS at the moment of the check and do not test live mail flow. Domains checked are not stored by PTS. PTS Managed Services Limited — ISO/IEC 27001 and ISO/IEC 20000 certified.