You paid for a website. Make sure it’s locked down.
Run a free scan of your domain and website and get plain-language results you can act on today.
We check only the public records attached to your domain. We never read your inbox or ask for a password. Your email is used to send this report, and the newsletter only if you tick the box.
–
What to do next
If these look unfamiliar, forward them to whoever manages your website or IT. They’ll know what to do.
Every check passed. Nothing to fix right now.
Where to set up SPF, DKIM, and DMARC
All checks
Next step
Want a hand with this?
Book a free 15-minute review of your results over Zoom. We’ll walk you
through what to fix first and what it means for your business.
Prefer it in writing? We’ll email you this report and your next steps.
or book a call
This automated scan is a starting point, not a full security audit.
What we check
The scan runs 13 checks in three groups. It only reads public information about your domain and website, so nothing on your site changes.
Mail servers (MX). Shows where your email is delivered, so messages reach the right inbox.
Website address (A and AAAA). Confirms your domain points to your website, including the newer IPv6 format.
Nameservers. Checks you have at least two, so one failure does not take your domain offline.
DNSSEC. Checks whether your DNS answers are digitally signed, so visitors reach your real site.
CAA. Checks whether you have limited which companies can issue certificates for your domain.
SPF. Lists which servers may send email as your domain, and how strict that list is.
DMARC. Tells inboxes what to do with mail that fails checks, and where to send reports.
DKIM. Adds a signature to your outgoing mail so receivers can see it really came from you.
MTA-STS. Looks for a policy that asks other mail servers to send to you over an encrypted connection.
BIMI. An optional record that can show your logo next to your email in supporting inboxes.
Two limits to know. We look for the most common DKIM selector names, so a custom setup can be missed. For MTA-STS we look for the published record, not the policy file behind it. Your mail provider, or a call with us, can confirm both.
TLS certificate. Checks your site’s certificate is valid and not close to expiring, so browsers connect without warnings.
HTTP security headers. Looks for five settings that tell browsers how to protect your visitors, such as HSTS and Content-Security-Policy.
PHP. Looks for signs your site runs PHP, the software behind WordPress, Drupal, Joomla, and Magento. If your site shows its PHP version, we tell you if it has the October 2026 security fix.
What your report looks like
Your report opens with a grade from A to F and a score out of 100. Below that is a ranked list of what to fix, followed by all 13 checks, passed or not. Add your email and we send the same report to your inbox.
Each item in the list shows a priority label, what we found, and the suggested fix. Here is what the labels mean:
CriticalFix this first. It has the biggest effect on your email or your site.
HighFix this soon. It leaves a real gap.
MediumSchedule it. Worth doing after the items above.
LowAn improvement for maximum security. Do it when it is convenient.
Why the order matters
The list runs from most to least important, so your first hour of work goes where it helps most. Some fixes also build on others. For example, DMARC only passes when SPF or DKIM is working.
The suggested fix tells you what to change. Choosing the right settings for your setup, and changing them without interrupting your email, is where a person helps. You can book a call after you see your results.
The Best Free DMARC Checkers (and When You Need More Than a Tool)
The right free DMARC checker depends on what you need. For a plain-language report and a person to help fix it, use the Tech in Peace scan. To see how many DNS lookups your SPF record needs, use dmarcian’s SPF Surveyor. For quick DNS and mail diagnostics, use MxToolbox. To have each part of your DMARC record explained, use EasyDMARC.
How they compare
Scroll sideways to see every column.
Tool
Free
Signup needed
Checks SPF/DKIM/DMARC
Human help
Tech in Peace scan
Yes
No
Yes (DKIM checks common selectors)
Yes, book a call
dmarcian Domain Checker
Yes
No registration, per dmarcian
Yes, all three
DMARC services offered
MxToolbox DMARC lookup
Yes
Not checked
DMARC lookup. SPF and DKIM are separate tools.
Managed services offered
EasyDMARC DMARC lookup
Yes
No account for its free tools, per EasyDMARC
DMARC lookup. SPF, DKIM, DMARC and BIMI in its Domain Scanner.
Support and managed setup offered
Based on each company’s public pages, checked October 16, 2026. Tools and terms change, so confirm on their sites. Free tools can have usage limits. “Not checked” means we did not verify that detail.
What a good checker should show you
Whichever tool you use, look for these six things in the results.
Record found. A DMARC record exists on your domain.
One record only. Two DMARC records at the same name cause DMARC to be ignored.
Valid syntax. The record is written correctly, so receivers can read it.
Policy level. Whether the policy is none, quarantine or reject.
Reporting set up. A reporting address (rua) so you receive reports about who sends as your domain.
SPF and DKIM alignment. A pass only counts when the checked domain matches your From domain.
The Tech in Peace scan reads your DMARC record, its policy level and its reporting address. Checking for duplicate records, syntax and alignment, and fixing them, is hands-on work we do with you on a call.
When a tool is not enough
A scan finds the problem. Someone still has to change your DNS without breaking your email. That takes the right policy for your mail, set in the right order. On a call we review your setup, make the changes with you, and check that your email keeps flowing.
Yes. Enter your domain and your results appear on screen at no cost. Add your email if you want the report sent to you. You do not need an account.
You can publish DMARC first, but mail only passes DMARC when SPF or DKIM passes and matches your From domain. Most domains set up both. A common start is DMARC at p=none to collect reports, then tighten the policy.
DMARC needs the SPF result to match your From domain. SPF checks a hidden sending address that can belong to a different domain, such as your email service. A matching DKIM signature can still make DMARC pass.
p=none is monitor mode. It asks receivers to take no special action on mail that fails DMARC, so you can collect reports first. It does not ask them to block spoofed mail. The usual next steps are quarantine, then reject, once reports look clean.
Scan after any change to your email provider, website host or DNS, and then every few months. Adding a new sending service is a common reason SPF or DKIM stops matching.
You see a grade, a score and a ranked list of fixes on screen. If you add your email, we send the same report. The scan only reads public information, so nothing changes on your domain. You can book a call if you want help with the fixes.
Alignment means the domain that passed SPF or DKIM matches the domain in your From address. DMARC passes when at least one of them passes and aligns. This stops a message from borrowing a pass from an unrelated domain.
Talk it through with a person
A scan shows you what to fix. A call gets it fixed. Book a discovery call and we will go through your results together, or get ongoing help with your devices and email.
