A DMARC, SPF and DKIM check for your organization
Can someone impersonate you by email?
A DMARC, SPF and DKIM check tests whether the organization's domain is set up so that fake emails in its name will be blocked or flagged. An SPF record determines which servers may send on behalf of the domain, DKIM signs the email, and DMARC determines what to do when the checks fail. You can check your domain for free here, as an initial indication.
Last updated: 19.10.2026 | Written and reviewed by the PhishingU team
DMARC, SPF and DKIM settings determine whether an impersonating email can be sent in your organization's name. PhishingU checks the state of the records and provides a practical recommendation for next steps.
* One allowlisting action by your IT team is required, and launch is subject to a security review of up to one business day.
What is an SPF record?
An SPF record is a DNS record that determines which servers may send email in your domain's name, and an SPF DMARC DKIM check shows whether someone can impersonate you by email. You can start with Free SPF and DMARC check, and read more about An email impersonation check for your organization.
SPF, DKIM, DMARC - what does each one do?
Defines which servers are authorized to send email in your name
Without SPF - any server can send an email "from you"
A digital signature that verifies the email was not altered
Without DKIM - legitimate emails may be rejected
A policy that combines SPF + DKIM and defines what to do with failures
Without DMARC - there is no policy and no reports on impersonation attempts
What do we check?
PhishingU checks your domain's public DNS records and provides an initial indication of the state of SPF, DKIM and DMARC. The check is fast, free of charge and has no access to internal systems.
Frequently asked questions about DMARC, SPF and DKIM
Ready to check your domain?
An initial check, free of charge, with no commitment - and with a practical recommendation for next steps.
* One allowlisting action by your IT team is required, and launch is subject to a security review of up to one business day.