Email security checker
Can someone send email that looks like it came from your firm? Enter your domain to check SPF, DMARC and DKIM, with each result explained in plain English.
Checked . Results come from public DNS and can take up to a few hours to reflect changes you make.
Why email security matters for regulated firms
Estate agents, conveyancers and accountants handle large payments and sensitive client information. A common fraud is an email that looks like it comes from your firm, telling a client to pay a deposit or completion money into a new account.
Three DNS records make that much harder:
- SPF lists the servers allowed to send email for your domain.
- DKIM signs your email so receivers can check it wasn’t forged or changed.
- DMARC tells receivers to quarantine or reject email that fails those checks, and sends you reports.
They protect your domain. Fraudsters can still use lookalike domains, so tell clients in writing that you will never change bank details by email, and ask them to confirm by phone.
How to fix the usual gaps
- One SPF record. Merge duplicates and end it with “~all” or “-all”. Keep it under 10 DNS lookups.
- Turn on DKIM in Google Workspace or Microsoft 365 admin, then publish the record they give you.
- Start DMARC in monitoring mode (p=none with a report address), check the reports for two to four weeks, then move to p=quarantine and p=reject.
- Optional extras: MTA-STS and TLS reporting for encrypted delivery, BIMI for your logo, DNSSEC with your DNS host.
Your IT provider or email host can make these changes. Run this check again afterwards.
Email security questions
What does this email security checker test?
It reads the public DNS records for your domain and checks SPF (which servers may send your email), DMARC (what receivers should do with email that fails), DKIM (whether your email can be signed), plus MTA-STS, TLS reporting, BIMI and DNSSEC. It explains each result in plain English and suggests a fix.
Why does this matter for estate agents, conveyancers and accountants?
Criminals pretend to be a firm by email to trick clients into paying deposits, completion money or invoices into the wrong account. With strict SPF and DMARC in place, inboxes can spot and block email that falsely uses your domain. It does not stop every scam, so keep telling clients you will never change bank details by email.
What is a good result?
A single SPF record ending in “-all” or “~all”, DMARC set to p=quarantine or p=reject with a report address, and DKIM switched on in your email system. Most firms on Google Workspace or Microsoft 365 can get there in an afternoon with their IT provider.
It says no DKIM key was found. Is DKIM off?
Not necessarily. DKIM keys live under a “selector” name that each provider chooses, and we only check common ones. Look in your email admin settings: Google Workspace and Microsoft 365 both have a DKIM switch.
Do you store the domain I check?
No. The domain is looked up in public DNS through Cloudflare and Google DNS, and the result is kept in a short cache for up to an hour so repeat checks are fast. We do not save who checked what.
Is this a security audit or identity check?
No. It is a quick, free check of public email settings. It is not a full security audit, and it does not verify anyone’s identity or replace the customer due diligence the Money Laundering Regulations require.
Check the clients behind the emails
AML Buddy runs ID, sanctions, PEP and adverse media checks for small UK firms. £5.40 a check, 5 free checks to start, no subscription.