Your legitimate business emails are silently landing in spam.

Because we measure one specific thing: whether someone can send email as that exact domain — not how secure the company is overall. gmail.com publishes p=none, which means no DMARC enforcement, so it scores low on that single axis. Google does this on purpose: at their scale, enforcing p=reject risks blocking legitimate mail from millions of senders, so they accept the exposure and rely on other defenses. That tradeoff makes sense for a global provider; it rarely makes sense for a business that sends invoices, contracts, or quotes to clients. Our score is deterministic and reproducible — anyone can reconstruct it from public DNS. And to be precise about scope: DMARC at enforcement stops spoofing of your exact domain; it does not stop look-alike domains or mail from an already-compromised mailbox.

Yes — completely. No signup, no email required, no card. It reads your domain’s public DNS records and shows you the result in about 10 seconds. There is one paid product: the $249 audit, for when you want the exact records to fix what the scan found.

We store the domain you scanned, the findings, and the score — that’s what lets us generate your audit if you buy one. We never access your mailbox, servers, or any private system, and we never sell data. Details in our Privacy Policy.

In February 2024, Google and Yahoo began requiring email authentication (SPF, DKIM, DMARC) from anyone sending in volume to their users, and Microsoft now applies the same requirements (Outlook, 2025). Across the board, major providers filter or reject unauthenticated mail far more aggressively than before — which means weak DNS records now hurt both your fraud exposure AND your own email’s ability to reach customers.

Not for you — we hand you the exact fix instead. The $249 audit gives you every finding plus the precise DNS records to paste into your registrar, so you or your IT person can apply them the same day. We do not offer a done-for-you implementation service.

Not when done in order — and the audit lays out that order for you. It identifies every legitimate sending service you use (mail host, marketing platform, CRM, invoicing tools), gives you the records that authorize each one, and tells you to confirm alignment before you tighten the policy. You control the pace.

No — and anyone who says so is overselling. DMARC at enforcement stops spoofing of your EXACT domain. Look-alike domains and compromised mailboxes are separate risks. We tell you exactly what’s covered and what isn’t.