Why email domain security matters
Email is the easiest way for criminals to reach your staff, patients and vendors — and the easiest way to do it convincingly is to send email that looks like it came from you. Without the right DNS records, anyone can send a message that shows your exact domain in the From line: a fake invoice to a client, a "new bank details" email to your vendor, or a phony billing notice to patients. This is called business email compromise, and it's a common and expensive kind of email fraud.
Three DNS records — SPF, DKIM and DMARC — let receiving mail servers tell real email from fakes. They're free to set up. They also help your genuine email reach inboxes instead of spam folders.
How SPF, DKIM and DMARC work together
Think of it like checking a delivery at the front desk. SPF is the list of couriers you've approved: when a message arrives, the receiving server checks whether it came from a server on your list. DKIM is a tamper-evident seal: your email system signs each message, and the receiver checks the seal against a public key in your DNS. DMARC is the instruction card: it tells the receiver what to do if a message claiming to be from your domain fails those checks — deliver it anyway (p=none), send it to spam (p=quarantine) or refuse it (p=reject). It also asks receivers to send you reports, so you can see who is sending email using your name.
Each record covers a weakness in the others, which is why you need all three. SPF can break when email is forwarded, and neither SPF nor DKIM on its own checks the From address people actually see. DMARC closes that gap.
What this checker looks at
| Record | Where it lives | What it does | What "good" looks like |
|---|---|---|---|
| MX | yourdomain.com | Says which servers receive your email | Points to your email provider |
| SPF | TXT at yourdomain.com | Lists servers allowed to send as you | One record, ends in ~all or -all, 10 or fewer DNS lookups |
| DKIM | selector._domainkey.yourdomain.com | Publishes the key used to sign your email | Signing turned on for your domain |
| DMARC | TXT at _dmarc.yourdomain.com | Tells receivers what to do with email that fails | p=quarantine or p=reject, with a reporting address |
How the grade works
The grade is a simple score out of 100. DMARC carries the most weight (45 points) because it's the record that actually stops spoofing of your visible address. SPF is worth 30 points and DKIM 25. An A means all three are in place and DMARC is enforcing. A domain with SPF and DKIM but no DMARC lands around a D, because fakes using your exact domain can still reach inboxes.
- A (90–100): fully protected. Keep your SPF record tidy as you add services.
- B (75–89): strong. Usually DMARC is at quarantine or there's one small issue.
- C (60–74): the basics exist, often with DMARC still on p=none (monitoring only).
- D (40–59): missing DMARC or a broken SPF record.
- F (below 40): little or no protection.
Common problems we find
- Two SPF records. Someone added a second one for a new service instead of editing the first. That makes SPF fail for everything. Merge them into one.
- Too many lookups. SPF allows a maximum of 10 DNS lookups. Every include: for a marketing, billing or reminder service adds at least one. Go over and SPF fails.
- DMARC stuck on p=none. Monitoring is the right first step, but many domains never move past it. Until you do, spoofed mail is still delivered.
- DKIM never switched on in Microsoft 365. Microsoft signs mail with its own onmicrosoft.com domain by default. Signing with your own domain takes a couple of DNS records and one switch in the Microsoft Defender portal.
- Forgotten senders. Patient reminder systems, online payment tools and scanners that email documents all send as your domain. They need to be in SPF (and ideally DKIM-signed) before DMARC goes to reject.
A safe order of operations
- Fix SPF so there is exactly one record that includes every legitimate sender.
- Turn on DKIM with your email provider, and for any other service that supports it.
- Publish DMARC at p=none with a reporting address, and read the reports for 2–4 weeks.
- Fix anything legitimate that fails, then move to p=quarantine.
- After another clean period, move to p=reject and run this check again.
If you use Microsoft 365, our phishing and business email compromise guide explains how these records fit with other protections like multi-factor authentication and email filtering. Practices sending patient information should also read HIPAA-compliant email encryption — SPF, DKIM and DMARC prove who sent a message, but they don't encrypt it.
Limits of this check
This tool reads public DNS records. It can't see inside your email system, so it won't know whether mail filtering, multi-factor authentication or outbound encryption are set up. It estimates SPF lookups rather than running a full SPF evaluation, and it can only find DKIM keys at the standard Microsoft 365 and Google selectors. If your result surprises you, have someone confirm it in your DNS host and email admin center.
Want it fixed for you?
Setting these records correctly — without blocking your own billing or reminder emails — is routine work for us. Beefed Up IT manages Microsoft 365 for small businesses and medical and dental practices as part of our managed IT services. Get in touch and send us your grade, and test your team with our Spot the Phish quiz.