How well is your email protected?
Fraudsters can send emails that look as if they came from your business. Your domain has public settings that make that harder. This free check reads them and gives you a score in seconds. No email address needed.
What the four checks mean
Approved senders list (SPF)
A public list of the services allowed to send email as your domain, such as Microsoft 365 or your accounts software. Email from anywhere else can be treated as suspicious.
Email signature (DKIM)
A digital signature added to every email you send. The receiving system checks it to confirm the email really came from you and wasn't changed on the way. If your email runs on Microsoft 365, it is switched on in Microsoft's security settings, with two records added to your domain.
Spoofing policy (DMARC)
Tells other mail systems what to do with an email that claims to be from you but fails the checks above. A policy of "none" only watches and reports. "Quarantine" sends fakes to junk, and "reject" turns them away altogether.
Mail routing (MX)
Shows where email for your domain is delivered, and confirms it is set up.
Why it matters
Without these settings, anyone can send an email that appears to come from your business, such as a fake invoice with new bank details. Missing settings can also send your genuine email to your clients' junk folders.
How the score is worked out
Mail routing counts for 15 points, the approved senders list for 25 and the email signature for 25. The spoofing policy counts for up to 35, depending on how strict it is. The check looks for email signatures under the names Microsoft 365, Google and other common providers use, so an unusual set-up can show as "not found" even when it is in place.
Fixing a low score
The fixes are settings on your domain, and they rarely take long once you know what to change. Book a free 15-minute call and we'll talk you through yours.
Is your Microsoft 365 the right fit?
Fifteen minutes on a call will tell you.