How easy is it to fake your email?
Attackers send invoices and password resets that look like they came from your domain. Get an instant grade for the records that stop them, with plain-language fixes.
Free, no sign-up. Reads public DNS only. Nothing is sent to the domain. We keep a 90-day log of domains checked, never your IP address.
Want an A? We'll fix it.
We set up SPF, DKIM, DMARC, MTA-STS, DNSSEC and CAA with your email provider, roll it out in stages so legitimate mail keeps flowing, and re-run this check with you at the end. Scoped and quoted up front, usually done in about two weeks.
Prefer to do it yourself? Choose the kit option and we'll email you when the Email Security Kit launches.
What we check
Eight public records that decide whether someone can impersonate your company by email, and whether your domain can be hijacked.
Lists the servers allowed to send email as your domain.
Signs your email so receivers can tell it wasn't altered or forged.
Tells receivers to block mail that fails SPF and DKIM, and sends you reports.
Who handles your email, and whether the domain should send mail at all.
Signs your DNS so attackers can't redirect your domain with forged answers.
Forces encrypted, verified delivery of email sent to you.
Alerts you when encrypted delivery to you fails.
Limits which certificate authorities can issue HTTPS certificates for you.
Common questions
Is the check really free?
Yes. No account and no email required.
What happens to the domain I enter?
The check runs in your browser and reads public DNS records through Mindflayer's server, which asks Cloudflare's public resolver (if that's unavailable, your browser asks Cloudflare's or Google's resolver directly). Nothing is sent to the domain itself. Mindflayer logs the domain, its grade, your browser family (for example Chrome on Windows) and basic automation signals for 90 days, to understand how the tool is used and to spot automated abuse. We don't store your IP address.
Can I check a domain I don't own?
Yes. These records are public by design: every mail server in the world reads them. Checking a supplier's domain is a quick way to spot phishing risk in your supply chain.
Why couldn't you find my DKIM key?
DKIM keys live under a "selector" name that only your email provider knows. We try the most common ones. If yours uses a custom selector, your DKIM may be fine even though we can't see it.
What does the grade mean?
It's a weighted score of the checks. DMARC and SPF count most, because they decide whether someone can send convincing email as you. A or B is strong. C or below means your domain is easy to spoof.
Can you fix it for us?
Yes. Our Email & Domain Security Setup service handles every fix with your email provider and rolls it out safely so legitimate mail keeps flowing. Request it here.