Can someone send emails pretending to be you?
Check your SPF, DKIM and DMARC settings in seconds, and get the exact fix for your own provider.
SPF, DKIM and DMARC in plain English
Anyone can write any "From" address on an email, a bit like writing any return address on an envelope. These three settings let other email providers check whether an email really came from you.
- SPF is a list of the services allowed to send email for your domain (for example Microsoft 365 or your web host).
- DKIM is a hidden signature added to your real emails, proving they weren't forged or changed.
- DMARC tells other providers what to do with emails that fail those checks: watch only (
p=none), send to spam (p=quarantine) or block (p=reject).
Why it matters for a small business
Without DMARC set to quarantine or reject, a fraudster can email your customers from your exact address asking them to pay a "new" bank account. Google, Yahoo and Microsoft now also expect these settings, so getting them right helps your real emails avoid the spam folder.
Will changing DMARC break my email?
Not if SPF and DKIM are set up first for everything that sends email as you. That's why our checker only suggests going straight to p=quarantine when it can see both are in place; otherwise it starts you in watch mode.
Want us to keep watch for you?
Nimbo Shield re-checks your website and email for you, warns you the same day about new threats and tells you if your site goes down. Try it free for 14 days, no card needed.