A list of approved senders
SPF is one TXT record at your domain that lists the servers and services allowed to send email for you, such as your mailbox provider and newsletter tool. A receiving server compares the sending server with that list.
FREE TOOL / EMAIL / DOMAIN SECURITY
Can someone send email
as your business?
Enter your domain to check the public DNS records that tell the world who may send email for you, how to treat forgeries and how to deliver mail securely. Each result comes with a plain-English explanation and a concrete fix.
Free, with no sign-up. The check runs in your browser: lookups go directly to the public DNS resolvers run by Cloudflare and Google. Nothing is sent to UrbanBytez and nothing is stored.
EMAIL & DOMAIN CHECK8 CHECKS
- MX
- SPF
- DMARC
- DKIM hints
- MTA-STS
- TLS-RPT
- DNSSEC
- CAA
WHEN YOU WANT A HUMAN REVIEW
Check your email domain
before changing it.
UrbanBytez’s free Email and DNS Security Check reads public DNS in your browser, without signup. Want help deciding what to change? Request the $295 technology assessment and choose Mail systems / migration.
The assessment covers one remote site or workflow, up to 90 minutes, with written priorities and a proposed next step. Appointment and written-summary delivery timing are agreed when scheduling. Configuration changes, implementation, equipment and ongoing support are separate. Remote launch focus: Atlanta, Dallas–Fort Worth and Houston.
Seeing Microsoft 365 error 550 5.7.708? Read what the code means and what to check next.
THE THREE RECORDS THAT MATTER MOST
What SPF, DKIM and DMARC do.
In plain language.
A tamper-evident signature
DKIM adds a cryptographic signature to each message. The matching public key sits in your DNS under a selector name, so a receiver can confirm the message was signed by an authorised system and was not altered on the way.
Your instructions for forgeries
DMARC ties SPF and DKIM to the From address people actually see. It tells receivers what to do when a message fails, from monitoring only (p=none) to quarantine or reject, and where to send reports about who is using your domain.
Secure delivery and trusted DNS
MTA-STS asks other mail servers to deliver to you only over verified encryption, and TLS-RPT reports when that fails. DNSSEC signs your DNS answers so they are harder to forge, and CAA limits which certificate authorities may issue certificates for your domain.
QUESTIONS
Common questions,
straight answers.
Do Gmail and Yahoo require SPF, DKIM and DMARC?
Since February 2024, Gmail asks everyone who sends to personal Gmail accounts to set up SPF or DKIM, use valid forward and reverse DNS for sending servers and keep spam complaints low. Senders of roughly 5,000 or more messages a day to Gmail must use both SPF and DKIM, publish a DMARC record (p=none is accepted), align the From domain with SPF or DKIM, and offer one-click unsubscribe on marketing mail. Yahoo publishes similar bulk-sender requirements without a fixed numeric threshold. Both name a spam complaint rate of 0.3% as a limit to stay under. Providers update these rules, so check their current sender guidelines.
Is a DMARC policy of p=none good enough?
p=none meets the published Gmail and Yahoo bulk-sender minimum and is the right place to start, because it collects reports without affecting delivery. It does not ask receivers to stop spoofed mail. Once the reports show your real sending services passing SPF or DKIM with alignment, move to p=quarantine and then p=reject.
Why did the check not find my DKIM key?
DKIM keys are published under a selector name chosen by your email provider, and DNS cannot list them. This check only tries common selectors such as google, selector1 and selector2. To find yours, open a message you sent, view the original headers and look for the s= value in the DKIM-Signature header. Not finding a key here is a hint to check, not proof DKIM is missing.
What is the SPF 10-lookup limit?
SPF allows at most 10 DNS-querying terms (include, a, mx, ptr, exists and redirect), counted across every include it pulls in. Past 10, receivers return a permanent error and SPF fails. Remove services you no longer use, and replace includes with fixed ip4 or ip6 ranges where a provider supports it.
Does a good grade guarantee my email reaches the inbox?
No. These records prove who is allowed to send as your domain and make impersonation harder. Inbox placement also depends on sending reputation, complaint rates, list quality and content, which no DNS check can measure.
HOW THIS CHECK WORKS
Public records only.
Nothing stored.
The check reads only records your domain already publishes to the whole internet. Your browser sends each DNS question directly to Cloudflare's public resolver at cloudflare-dns.com, falling back to Google Public DNS at dns.google if Cloudflare cannot be reached; those providers' own privacy policies apply to the lookups. This page loads no analytics, advertising or third-party scripts, and UrbanBytez never receives the domain you check. Results reflect public DNS at the moment you run it.
Where we begin
Ask us about your email setup Inquiring is free and carries no payment or project commitment. A $295 technology assessment is available when you want a structured review and a written recommendation. We review U.S. requests, with Atlanta, Dallas and Houston as our launch focus.
Prefer to talk? Call (770) 904-1800 or email sales@urbanbytezllc.com. Do not send passwords, DNS logins or sensitive customer information.