Free tool · results in seconds · nothing to install
Can someone send email as your company?
Most invoice and wire fraud starts with an email that looks like it came from you or your vendor. Enter your domain to check the records that stop it (SPF, DKIM and DMARC) and the DNS settings behind your website and email (DNSSEC, certificate rules and name servers), and get a grade with plain-English fixes.
We only read public DNS records. Nothing is sent, stored or shared.
Why these records matter
Business email compromise — fake invoices, changed bank details, “urgent” requests from the boss — is the most expensive cybercrime businesses face. Attackers prefer domains that don’t publish SPF, DKIM and an enforcing DMARC policy, because their fake emails sail straight into inboxes using your exact address.
Setting these records up correctly is quick, but getting to DMARC p=reject without blocking your own newsletters, invoicing system or CRM takes care. As part of Managed Care we set up SPF, DKIM and DMARC for you, monitor the reports and move you to full enforcement safely — alongside email security, phishing training and a help desk that answers in under 60 seconds.
Email security questions
What does the email & DNS security check look at?
Only public DNS records: your mail servers (MX), SPF, DKIM, DMARC, MTA-STS with TLS reporting, and for the domain itself DNSSEC signing, CAA certificate rules and the name servers. These records decide whether someone can send email that looks like it came from your domain, or redirect your visitors and mail. We don’t send email, log in anywhere or scan your network.
What are SPF, DKIM and DMARC?
SPF lists the servers allowed to send email for your domain. DKIM adds a digital signature to every message so receivers can confirm it’s genuine. DMARC ties the two together and tells receivers what to do with email that fails — let it through, send it to spam or reject it — and sends you reports.
Why does DMARC p=none count as a warning?
p=none is monitor-only: it collects reports but doesn’t stop spoofed email. It’s the right first step, but the protection only starts when you move to p=quarantine and then p=reject, once the reports show all your real senders pass.
It says DKIM wasn’t found, but we use it. Why?
DNS can’t list DKIM keys, so we check the selector names Microsoft 365, Google Workspace and common email services use. If your provider uses a custom selector, your DKIM may be fine. We can confirm it in a free on-site review.
Is this check stored or shared?
No. We look up the domain’s public DNS, show you the result and keep it in memory for a few minutes so repeat checks are fast. The domain isn’t saved to a database or shared.
What are DNSSEC and CAA?
DNSSEC signs your domain’s DNS answers, so nobody can forge them to send your visitors or your email somewhere else. A CAA record names the certificate authorities allowed to issue HTTPS certificates for your domain, so a fraudulent certificate is much harder to get. Both are switched on at your DNS host.
Customer service first · we re-earn your business on every ticket
Obsessive about service. Relentless about the details.
CAL IT Group brings enterprise-class IT, cybersecurity and SOC 2 Type II–audited operational excellence to small and midsize businesses across Southern California — a customer service organization first and foremost, proven day in and day out for over 10 years.