Email security
Can someone fake your email? A free SPF, DKIM and DMARC check, graded A to F
Check whether anyone can send email pretending to be your domain or your suppliers. Free, no account, graded A to F, with the exact DNS records that raise the grade.
Varaxon Technologies · · 5 min read
Why this matters
Fake invoices and "we've changed our bank details" emails work because many domains still let anyone send mail in their name. Nothing has to be hacked. The scammer just writes your address in the From line, and if your domain doesn't tell mail servers to refuse it, the email lands in the inbox looking real.
Three DNS records decide this: SPF (which servers may send for you), DKIM (a signature that proves a message really came from you) and DMARC (what receivers should do with mail that fails those checks). We built a free check that reads them and tells you, in plain words, whether fake email in your name is stopped.
What the check looks at
- Fake email in your name. SPF and DMARC: whether mail servers are told to refuse, junk or deliver email that pretends to come from you.
- Signed email. DKIM keys under the names common mail services use, and whether they are long enough.
- Encrypted delivery. MTA-STS and TLS reporting, which make other servers insist on encryption when they send to you.
- Domain and DNS. Registration expiry, the registrar lock, DNSSEC and CAA, from the registry's public record.
- Lookalike domains. About 400 typo and look-alike names of your domain, and which of them are set up to send or receive email.
- Your suppliers. The same spoofing basics for up to three companies you pay, because fake invoices usually pretend to come from one of them.
Every answer shows the record it came from, so you can check it yourself.
How the grade works
The grade follows fixed rules, so the same records always get the same grade:
| Grade | What it means |
|---|---|
| F | Fake email is not stopped, and SPF is missing or broken. |
| D | Fake email is not stopped: no DMARC record, a broken one, or p=none. |
| C | Fake email is only partly stopped (for example sent to junk), or something else must be fixed now. |
| B | Fake email is refused, with smaller items left to improve. |
| A | Fake email is refused and nothing is left to fix. |
Lookalike domains are listed but never change the grade, because they are other people's registrations, not your setup.
Under the grade is How to raise the grade: only the steps that change it, in order, each with the exact record to publish. Each item is labelled Needed for B (or whichever grade it unlocks) or Optional, so you know what to do first and what can wait.
We ran it on our own domain first
varaxontech.com got a D. Our DMARC record was set to p=none, which only asks for reports and stops nothing. We changed it to p=quarantine, so fakes go to junk, and turned on DKIM signing with our mail provider. The next check gave a C, and the before and after report showed exactly what changed.
The last step is p=reject, which tells servers to refuse fakes outright. We are waiting one to two weeks first, reading the DMARC reports to make sure none of our own real email fails the checks. That order (p=none with reports, then quarantine, then reject) is the safe way to roll DMARC out on any domain.
For your clients: a white-label report with before and after
If you look after other companies' IT, the same check runs inside Scan Hub for each client, at no cost:
- A white-label PDF with your logo, the grade, the steps to raise it and the evidence behind every answer.
- A fingerprint (SHA-256 of the check's facts) printed on the report, so anyone can confirm the facts were not changed.
- Since the last check. Run it again after the fixes and the report shows the grade, each finding and each supplier before and after. The client sees the work was done.
- Supplier checks for the companies your client pays, which makes a good conversation about invoice fraud.
It sits next to the client's vulnerability reports, so email security, scan results and proof of fix are in one place.
How it's checked, and what it can't see
Only public records: DNS answers read through Google and Cloudflare DNS-over-HTTPS, the registry's public RDAP record, and your published MTA-STS policy file if there is one. We never connect to your mail servers or send any email. On the public page, results are held in memory for ten minutes and then discarded. Nothing is stored or linked to you.
- DKIM keys can only be looked for under common names. A key under another name is not visible from outside, so "not found" does not prove DKIM is off.
- Lookalike names come from fixed typo and look-alike rules, so some lookalikes may not be in the list.
- A DNS change can take up to the record's TTL to show everywhere, so recheck a little later if a fix doesn't appear straight away.
Common questions
Is the email check really free?
Yes. The public check at varaxontech.com/email-check needs no account. Inside Scan Hub, email checks for your clients don't use a report or a credit.
What DMARC policy should I use?
End at p=reject. Start with p=none and a reporting address, read the reports for a week or two to find any real senders that fail, fix them, then move to p=quarantine and finally p=reject.
Does the check send email or log in to anything?
No. It only reads public DNS and registry records and the published MTA-STS policy file. It never connects to a mail server.
Turn your next scan export into a client-ready report.
Run a free pre-flight check