Is your email domain secure?
Free check for SPF, DKIM, DMARC, blacklists, MX and more – instant results, no sign-up required.
SPF check
Sender Policy Framework – who is allowed to send email on behalf of your domain?
DKIM check
DomainKeys Identified Mail – the digital signature on your outgoing email.
DMARC analysis
Domain-based Message Authentication, Reporting and Conformance – protection against phishing in your name.
Blacklist check
Is your mail server on a spam blocklist? We check five well-known DNSBLs.
MX records
Are your mail servers listed correctly in DNS and do they resolve?
Reverse DNS
The PTR record of your primary mail server – essential for reliable email delivery.
What does the email security check examine?
email-checken.de reads your domain’s public DNS records and assesses eight items. You get a score from 0 to 100 and, for each item, a status with a specific recommendation.
- SPF record: whether exactly one SPF record exists and how it ends ("-all", "~all", "?all" or "+all").
- DMARC record: whether a record exists under _dmarc and which policy applies (none, quarantine or reject).
- DKIM: whether a key is published under common selectors such as default, google or selector1.
- MX records: whether mail servers are listed and the primary mail server resolves.
- Blacklists: whether the IP addresses of your primary mail server are listed on SpamCop, Barracuda, UCEPROTECT, PSBL or Mailspike.
- Reverse DNS (PTR): whether the IP address of your primary mail server has a PTR record.
- MTA-STS and TLS reporting: whether the DNS records for encrypted delivery and TLS failure reports are in place.
SPF, DKIM and DMARC in a nutshell
SPF specifies in DNS which servers may send email for your domain. This lets receivers spot senders who merely pretend to be your domain.
DKIM adds a digital signature to outgoing email. Using the public key in DNS, receivers can verify that a message wasn’t altered in transit.
DMARC builds on SPF and DKIM and tells receivers what to do with email that passes neither check: deliver it, move it to spam or reject it.
Who is the check for?
For businesses, freelancers, associations and agencies that send email from their own domain – and for webmasters who want to make sure everything is set up correctly after switching email providers. No technical background is needed.
Frequently asked questions
Is the email security check free?
Yes. The check is free of charge and requires no sign-up. All you enter is a domain or an email address.
Does the check send emails or access my mailbox?
No. The check only reads your domain’s public DNS records. No emails are sent and no mailbox is accessed. If you enter an email address, only the domain after the “@” is checked.
How is the score from 0 to 100 calculated?
Each item is weighted: SPF and DMARC count 25 points each, DKIM 20, MX records and the blacklist check 10 each, reverse DNS 5, MTA-STS 3 and TLS reporting 2. A passed item earns the full points, a warning earns part of them.
Why doesn’t the check find my DKIM key?
DKIM keys are published under a selector chosen by your email provider. The check tries common selectors such as default, google, selector1 or k1. If your provider uses a different name, you’ll see a warning even though DKIM may be set up.
What is the badge and how up to date is it?
After the check, you can add a badge to your website that shows the security status of your email domain. To make this work, we store the domain, the result and the time of the check; the domain is re-checked automatically about every 14 days.
Does a good score mean my emails will always be delivered?
No. A high score shows that the key DNS settings are correct. Whether an email is delivered also depends on its content, your sending behaviour and the recipient’s filters.