● Free tool
Can scammers send email as your business?
Enter your domain to check your SPF, DKIM and DMARC in seconds. You'll get a grade, a plain-English explanation of every result, and exactly what to fix.
● What we check
Three records that stop fake emails
Most small businesses are missing at least one of them, which lets criminals send fake invoices and payment requests that look exactly like yours.
Who's allowed to send
A list of the services allowed to send email as your domain, like Google Workspace, Microsoft 365 or your invoicing software. Everything else is suspicious.
A tamper-proof signature
Every email you send carries a digital signature that proves it really came from you and wasn't changed along the way.
What to do with fakes
Tells Gmail, Outlook and everyone else to block email that fails SPF and DKIM, and sends you reports about who is trying to impersonate you.
We also check your mail servers and optional extras: encrypted delivery (MTA-STS), delivery reports (TLS-RPT), signed DNS (DNSSEC) and brand logos in inboxes (BIMI).
Questions
What is email spoofing?
Email spoofing is when a scammer sends an email that appears to come from your business's address. It's used to send fake invoices, change payment details, and steal passwords from your customers and staff. SPF, DKIM and DMARC together stop it.
What do SPF, DKIM and DMARC do?
SPF lists the services allowed to send email for your domain. DKIM adds a digital signature to each email. DMARC tells receiving mail servers to block or quarantine email that fails those checks, and sends you reports. You need all three for real protection.
My DMARC policy is p=none. Am I protected?
Not yet. p=none only monitors: fake emails are still delivered, and you just receive reports about them. It's the right first step, but you should move to p=quarantine and then p=reject once your real email passes.
Why does it say no DKIM key was found when I set it up?
DKIM keys are published under a name called a selector, and there's no way to list them all. We check the names Google Workspace, Microsoft 365 and most email services use. If you use a custom selector, open Advanced, enter it, and run the check again.
Is this check safe? Do you store my results?
Yes, it's safe. The check only reads public DNS records that anyone on the internet can see. We don't send any email, don't touch your mail servers, and don't store your domain or results.
Can you fix these problems for me?
Yes. Code4 sets up SPF, DKIM and DMARC and moves them to full enforcement without interrupting your email, usually within a few days. Call 949-438-8364 or use the "Fix this for me" button in your results.
Want it fixed without the guesswork?
We set up SPF, DKIM and DMARC for Google Workspace and Microsoft 365 businesses across Orange County and nationwide, at a fixed price, without interrupting your email.