Free check · no sign-up · nothing installed
Can someone send
email as your company?
Three public records decide it, and most UK businesses are missing at least one. We read them the same way every mail server does — no access to your systems, no sign-in, nothing to install. You get the answer, and the exact records to fix it.
What the three records do
They are not three versions of the same thing, and only one of them stops anything. A domain with the first two and not the third looks protected and is not — which is the single most common state we find.
SPF
Who is allowed to send
Lists the mail servers permitted to send using your domain — Microsoft 365, plus whatever else sends on your behalf: payroll, your CRM, the accounts system. Without it, nothing distinguishes your mail server from anybody else's.
DKIM
A signature that survives forwarding
Signs each message so it still verifies after being passed on — through a mailing list, or somebody's own forwarding rule. Without it, legitimate forwarded mail can fail checks and be treated as a forgery, which is usually why enforcement gets rolled back after complaints.
DMARC
The only one that actually blocks anything
Tells receiving servers what to do when the first two do not check out. Without it — or with it set to p=none, which reports and then delivers anyway — the other two are advisory notes no server is obliged to act on. This is the one most organisations are missing, and the one that decides whether a forgery arrives.
What an unprotected domain costs
This is not about spam reaching you. It is about mail leaving in your name, to your customers and suppliers, with your reputation attached to it.
The invoice that was never yours
A supplier receives an invoice from your finance director's address with different bank details on it. It is not a lookalike domain — it is your domain, so it passes every eye test and lands in the inbox. The money goes, and the conversation about whose fault it was starts weeks later.
The request from the managing director
A member of staff gets an urgent message from a name they know, asking for a payment, a gift card or a payroll change. Training helps people spot a wrong address. It does not help when the address is right.
The reputation you cannot see
Mail sent in your name that you never see and never hear about, to customers and suppliers who assume it came from you. The first you know is when somebody mentions it, if they mention it at all.
You get the fix, not just the diagnosis
The result includes the actual DNS records to publish, in the order they have to be done, with a warning against every step that could stop legitimate mail. Take it to whoever hosts your DNS and it is an hour's work. We would rather you had it working than had it from us.
It is free because it is the only part of your Microsoft 365 anybody can check from the outside. The rest — who can sign in without multi-factor, which third-party applications can read your mail, what is shared with the whole company — needs a look inside the tenant.