A free check from Vitals, an Innova Group product
No sign-up · nothing installed
Can someone send
email as your company?
SPF, DKIM and DMARC help receiving mail systems determine whether a message is authorised to use your domain and what to do when authentication fails. We inspect the records published in public DNS—no access to your systems, no sign-in and nothing to install. You receive a clear result and practical guidance on anything that needs attention.
What the three records do
The three records do different jobs and work together. SPF identifies permitted sending systems, DKIM adds a verifiable signature, and DMARC checks whether those results align with the domain shown in the visible From address.
SPF
Who is authorised to send
SPF lists the systems permitted to send using a domain—such as Microsoft 365, payroll software, a CRM or an invoicing platform. Receiving systems can use the result when deciding how to handle a message, but SPF does not protect the visible From address by itself.
DKIM
A verifiable signature on the message
DKIM adds a cryptographic signature that allows a receiving system to verify the signing domain and whether the signed parts of the message changed in transit. Some forwarding services and systems that modify messages can still cause verification to fail.
DMARC
The policy that joins the checks together
DMARC checks whether SPF or DKIM aligns with the domain shown in the visible From address. It also publishes the domain owner’s requested handling for messages that fail—monitor, quarantine or reject. The receiving mail system makes the final delivery decision.
This check covers exact-domain email spoofing. It cannot prevent attacks using lookalike domains, compromised accounts or misleading display names.
What an unprotected domain costs
This is not about spam reaching you. It is about mail leaving in your name, to your customers and suppliers, with your reputation attached to it.
The invoice that was never yours
A supplier receives an invoice from your finance director's address with different bank details on it. The visible address can use your genuine domain, making the message much harder to spot. Whether it is delivered depends on the receiving mail system and the authentication policy it applies. The money goes, and the conversation about whose fault it was starts weeks later.
The request from the managing director
A member of staff gets an urgent message from a name they know, asking for a payment, a gift card or a payroll change. Training helps people identify suspicious messages, but the task becomes harder when the visible address uses the organisation’s genuine domain.
The reputation you cannot see
Mail sent in your name that you never see and never hear about, to customers and suppliers who assume it came from you. The first you know is when somebody mentions it, if they mention it at all.
You get practical next steps, not just a score
The result identifies missing or weak records and explains what should be reviewed. Where a safe record can be determined from public information, the check provides it. Before moving DMARC to quarantine or reject, every legitimate service that sends email for the domain should be identified and tested so genuine messages are not affected.
You can take the findings to whoever manages your DNS, or ask Innova Group to help implement them properly.
It is free because email-domain authentication is visible in public DNS. The remaining Vitals checks—identity, application access, sharing, licensing and the groundwork for a Copilot pilot—require read-only access to the Microsoft 365 tenant.