Email security test: SPF, DKIM and DMARC
Free, no sign-up, in a few seconds. The test reads your domain's public DNS records and tells you whether it can easily be spoofed.
Test your email security in 10 seconds
Four public checks on your domain name. This is the bare minimum: if it is not in place, nothing else really is.
Results for What the test checks
- Mail serversPending
Where your emails arrive, and whether they are hosted on Microsoft 365.
- SPFPending
Which servers are allowed to send emails on your behalf.
- DKIMPending
Whether your outgoing emails are signed, to prove they come from you.
- DMARCPending
What recipients do with an email that spoofs your domain.
This test: 4 checks out of more than 180. The other 180 can only be checked from inside your tenant.
What no external test can see
- Admins without MFA
- Legacy authentication still open
- A mailbox forwarded outside
- Files shared with everyone
- Apps that read your email
Sentinel Audit365 checks them from inside your tenant, every month.
What the test checks
- Mail servers (MX): where your emails arrive. The test detects whether your email is hosted on Microsoft 365 (Exchange Online).
- SPF: whether there is a single record, and how it ends.
-allrejects unauthorised servers;~allmerely flags them. - DKIM: for Microsoft 365, the test queries the
selector1andselector2selectors and checks that a key is actually published, meaning that signing is active. - DMARC: whether the policy exists, its level (
none,quarantineorreject), the percentage of emails covered and whether reports are requested.
How to read the results
- Compliant the item is in place and correctly configured.
- Warning the item exists but offers weak protection, for example DMARC in monitoring mode only.
- Non-compliant the item is missing or ineffective: your domain can be spoofed.
- Not verifiable the information is not visible from outside, for example a DKIM selector specific to another provider.
Why this is only the bare minimum
These four checks have one thing in common: they are public. Anyone can read them, including an attacker preparing a phishing campaign. They tell you whether the front of your email setup is in order, not what happens behind it.
Yet most of the risk lies inside the tenant, where no external test can look:
- administrators who sign in without MFA;
- legacy authentication still open, which bypasses MFA;
- a rule that quietly forwards a mailbox to an external address;
- files shared "with everyone";
- third-party applications that read your emails with a user's consent.
A perfect result here is good news, and it is exactly the right time to check the rest. Sentinel Audit365 runs more than 180 checks from inside your tenant, read-only, every month.
4 checks out of 184. That is the share of the audit visible from outside. Request the full audit, or see everything we check on email.
Test privacy
The test runs entirely in your browser. It queries public DNS through Cloudflare's DNS-over-HTTPS resolver (cloudflare-dns.com). SF2i neither receives nor stores the domain you enter, and no account is needed. The information read is public by nature: it is what any mail server receiving one of your emails looks up.
Ready to see what your tenant is hiding? First report within 48 h.
A subscription, an automatic audit every month, nothing to launch. A first conversation is enough to get started. We work in New Caledonia, French Polynesia and France.
- New Caledonia+687 24 23 22
- French Polynesia+689 40 42 90 79
- France+33 2 96 47 48 05