Scan your domain with DMARC Busta's Domain Tester and learn about any issues with DMARC, SPF and DKIM records.
Check your email security now
Free forever · No credit card · 30 second setup
Or get your full detailed report by email
Our Australian team will set up and manage your email security — you don't need to touch a thing.
From $25/month per domain
We'll call you within 1 business day · Australian-based support
We'll call you within 1 business day.
Your scan results have been saved.
Protect your domain from spoofing and phishing attacks with proper DMARC configuration.
Ensure your SPF records are correctly configured to authorize legitimate email senders.
Verify email authenticity with DKIM signatures to build trust with recipients.
Three DNS protocols that verify whether an email genuinely comes from the domain it claims
Email authentication is a set of protocols that verify whether an email genuinely comes from the domain it claims to be sent from. Three protocols work together to protect your domain: DMARC (Domain-based Message Authentication, Reporting and Conformance), SPF (Sender Policy Framework), and DKIM (DomainKeys Identified Mail).
SPF specifies which mail servers are authorised to send email on behalf of your domain. DKIM adds a cryptographic signature to each message, allowing receiving servers to verify the email has not been tampered with in transit. DMARC ties SPF and DKIM together by telling receiving servers what to do when authentication fails — and provides reporting so you can monitor who is sending email as your organisation.
Without proper email authentication, your domain is vulnerable to spoofing and phishing attacks. Attackers can send emails that appear to come from your organisation, damaging your brand reputation and putting your customers at risk. Beyond security, poor authentication directly impacts email deliverability — legitimate emails from your domain may land in spam folders or be rejected entirely because receiving servers cannot verify their authenticity.
v=DMARC1;
p=reject;
rua=mailto:dmarc@example.com;
pct=100
A comprehensive analysis of your email authentication setup across all three protocols
Checks whether a valid DMARC record exists in your DNS and evaluates the enforcement policy. A policy of p=none only monitors, while p=reject provides full protection against spoofing.
Verifies that your SPF record is syntactically correct and counts the number of DNS lookups it requires. The SPF specification limits records to 10 DNS lookups — exceeding this causes authentication failures for all your outbound email.
Checks for DKIM records on common selectors and verifies the key configuration. Properly configured DKIM ensures receiving servers can validate the integrity and authenticity of your emails.
Each protocol is scored individually and combined into an overall security rating out of 100. This gives you a clear picture of where your domain stands and what needs attention.
Actionable fixes for the most frequent email authentication problems we detect
Your domain has no DMARC record, leaving it completely vulnerable to email spoofing. You need to add a TXT record at _dmarc.yourdomain.com.
Fix: Start with a monitoring policy to collect data before enforcing. Use our DMARC Generator to create the correct record.
Or let DMARC Busta set this up automatically
Each include:, a:, mx:, and redirect: mechanism counts as a DNS lookup, and nested includes count too.
Fix: Consolidate redundant includes, replace mechanisms with direct IP ranges, or use SPF flattening to reduce your count below 10. Check your current record with our SPF Checker.
DMARC Busta's Autopilot flattens and manages your SPF automaticallyFix: DKIM requires generating a public/private key pair and publishing the public key in your DNS. Most email providers (Google Workspace, Microsoft 365, Mailgun) provide DKIM keys that you add as CNAME or TXT records. Our DKIM Generator can help you create the correct records.
Need help? Our DKIM setup guides walk you through itp=none
p=quarantine
p=reject
Fix: Progress from p=none to p=quarantine and finally p=reject. This progression typically takes 4 to 8 weeks when done carefully.
Autopilot Mode — DMARC Busta monitors your email authentication continuously, progresses your DMARC policy safely, and automatically repairs common issues before they affect your email delivery.
Start Freep=reject, which provides the strongest protection against email spoofing. Even a score of 70 or above indicates a solid foundation, but anything below that leaves significant gaps in your email security.
More free tools to secure your email authentication
Stop manually managing DNS records across dozens of domains. DMARC Busta monitors your email authentication continuously and fixes issues automatically with AI-powered Autopilot.
Get Started FreeWe'll send a detailed DMARC, SPF & DKIM analysis to your inbox.
Check your inbox for your security report for .