Can someone send email pretending to be you?

They're three short records in your domain's settings (DNS). SPF lists the services allowed to send email as you. DKIM adds a digital signature that proves an email really came from you. DMARC tells other mail servers what to do with email that fails those checks: deliver it, send it to spam, or block it.

Without them, anyone can send email that looks like it came from your address, like a fake invoice to your customers or a payment change request to your bookkeeper. Google, Microsoft and Yahoo also now send email from domains without these records to spam, or reject it.

Yes. It only reads records your domain already publishes to the whole internet. Nothing on your side is touched or changed, and we don't save the domain unless you ask us to email you the report.

DKIM keys sit under a name your email service picks, and there's no way to list them. We check the names Microsoft 365, Google and the popular email services use. If yours uses a custom name, your email may still be signed. Check your email service's settings, or ask us.

An A or B. That means all three records are in place and DMARC is set to send fakes to spam (quarantine) or block them (reject). Getting there is usually a few small changes, done carefully so your real email keeps flowing.