Free · No signup · No install — just paste a domain

Email security & DNS tools

Everything you need to audit, build, and fix the DNS records that protect your brand from spoofing — DMARC, SPF, DKIM, BIMI, MTA-STS, and TLS-RPT. Paste a domain, get a verdict. No account required.

Flagship

Free Domain Scan

Scan your brand for active lookalike domains across 150 typosquat, bitsquat, TLD-swap, and homoglyph variants in one pass. The flagship tool — no signup.

Run a free scan

DMARC

DMARC Record Checker

Look up and validate the DMARC record on any domain. Spot policy, reporting address, and alignment mode in seconds.

DMARC Record Generator

Build a correct DMARC TXT record with the right policy, alignment, and reporting address for your domain.

SPF

SPF Record Checker

Look up the SPF record on any domain, count DNS lookups, and flag the 10-lookup limit that causes authentication to fail.

SPF Record Generator

Build an SPF TXT record from the senders you use — Google Workspace, Microsoft 365, SendGrid, Mailgun, and custom IPs.

SPF Flattener

Recursively expand every include:, redirect=, a, and mx in your SPF record down to raw IP4 / IP6 ranges. Solves the RFC 7208 10-lookup PermError without changing your authorised senders.

DKIM

DKIM Record Checker

Look up the DKIM public key on any selector. Confirm the record is published correctly, parse the key type and algorithm, and spot common misconfigurations.

BIMI

BIMI Record Checker

Look up the BIMI record on any domain and see whether your brand logo will render in Gmail, Apple Mail, and Yahoo inboxes.

BIMI Record Generator

Build a BIMI TXT record linking to your SVG logo and optional VMC certificate. Required for your brand logo to appear in supporting inboxes.

MTA-STS

MTA-STS Record Checker

Look up the MTA-STS TXT record and fetch the policy file. Confirm your inbound mail servers enforce TLS and block downgrade attacks.

MTA-STS Policy Generator

Build the DNS record and policy file MTA-STS needs to force TLS on all inbound mail to your domain.

TLS-RPT Record Checker

Look up the TLS-RPT record to confirm receivers know where to send TLS failure reports for your domain.

TLS-RPT Record Generator

Build a TLS-RPT TXT record so you receive daily reports of TLS-related delivery failures from major inbox providers.

DNS

DNS Record Lookup

Look up any DNS record type (A, AAAA, MX, NS, TXT, CNAME, SOA, CAA) for any domain. Fast, server-side, no signup.

Reverse DNS Lookup

Paste an IPv4 or IPv6 address to get the PTR record. Useful for verifying mail-server rDNS, tracing suspicious connections, and confirming hosting providers.

DNSSEC

DNSSEC Checker

Verify the DNSSEC signing chain end-to-end on any domain. Checks DS records at the parent zone, DNSKEY at the child, signing algorithm, and the AD (authenticated-data) bit from a validating resolver.

Security

HTTP Security Headers Analyzer

Fetch any URL and grade the security-relevant response headers — CSP, HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy, and the cross-origin isolation set. A through F score with concrete fixes.

Threats

Email Header Analyzer

Paste the raw headers from a suspicious email. Parse the Received chain, SPF / DKIM / DMARC results, and spot spoofing in seconds.

Phishing Link Checker

Paste a suspicious URL to inspect it without clicking. Checks domain age, registrar, hosting, and known-bad-URL databases (PhishTank verified entries, Google Safe Browsing) and reports a verdict with the evidence behind it.

Beyond one-shot checks: monitor your brand continuously

These tools give you a snapshot. PhishFence catches new lookalike registrations, DMARC drift, and spoofing campaigns the moment they happen. Sign up free, monitor one domain forever.

Start monitoring free