Send us your domain and we check how well it is protected against spoofing: your SPF, DKIM and DMARC records, how strict they are, and how easily someone could send convincing email in your name. We need nothing but the domain. No access, nothing to install, and reviewed findings back in plain terms.
Just the domain you send email from, and where to send the results.
We won't sell your data or send you marketing you didn't ask for.
Payment fraud rarely needs a hacked server. An attacker sends an email that appears to come from your domain, or a supplier's, with new banking details or an urgent invoice. If your domain has no enforced DMARC policy, receiving mail servers have little reason to reject it.
The large mailbox providers now expect organizations that send email in bulk to authenticate it with SPF, DKIM and DMARC, and they have tightened how they treat mail that does not. If invoices, newsletters or system notifications start landing in spam, authentication is the first place to look.
The check suits any organization that sends email from its own domain: finance teams issuing and paying invoices, firms whose clients send money on instructions received by email, and businesses asked about email security on an insurance renewal or client questionnaire.
Related: free Microsoft 365 security check, cyber insurance IT requirements, free external vulnerability scan and managed cybersecurity.
Microsoft 365 Security CheckThe check reads your public DNS records, the same way any mail server on the internet does. That is useful, and it is also where it stops.
We look only at the domain you give us, and only at records that are already public. If you want the records fixed or a DMARC rollout managed, that is paid work, scoped with you before anything starts.
Every receiving mail server looks up the same public records before deciding whether to trust a message from you. We read them, test them and explain what they mean.
Which servers are allowed to send as your domain, whether the record is valid, and whether it ends in a policy that actually means something.
Whether the mail you send is signed, which services sign it, and whether the expected keys for your mail platform are published.
Whether you have a DMARC record, whether it is set to monitor, quarantine or reject, and how much of your mail it applies to.
Whether aggregate reports are sent anywhere, and whether anyone reads them to spot spoofing attempts.
Taken together, how easy it would be for someone else to send email that appears to come from your exact domain.
Accounting, CRM, newsletter and ticketing platforms that send on your behalf, and whether they are covered by SPF and DKIM.
Whether your authentication is in line with what the large mailbox providers now expect from organizations that send email in volume.
Your MX records and the mail platform they point to, so the advice fits the system you actually use.
We only need the domain. There are no accounts to create, nothing to install and no access to grant.
The domain you send email from, plus a name and email address for the results.
SPF, DKIM, DMARC and MX records, checked from outside the way any receiving mail server sees them.
Someone at NetFusion Designs interprets the results before you see them. Findings come back in a few business days.
If you want, we walk through what to change first and whether your current provider can do it. There is no obligation.
Moving DMARC to enforcement is usually done in stages so legitimate mail is not blocked. We will tell you honestly how far along that path you are.
SPF, DKIM and DMARC each marked as in place, weak or missing, with the reason.
How easily your domain could be impersonated today, explained for a finance lead or owner, not only for IT.
The specific record changes that would close the gaps, sequenced so legitimate mail keeps flowing.
Services that appear to send as you and need to be authorized before DMARC is tightened.
Where your current setup affects how you can honestly answer email security questions from an insurer or client.
If your records are in good shape, we will say so. Your own IT team or provider is welcome to make any changes.
We are not going to manufacture a crisis to start a sales conversation. If your domain is well protected, we will tell you that, and if your current provider can fix the gaps, we will say so.
They are public DNS records that let receiving mail servers check whether a message really came from your domain. SPF lists the servers allowed to send for you, DKIM adds a signature to each message, and DMARC tells receivers what to do when a message fails those checks.
No. Everything we check is already published in public DNS. We need the domain name and nothing else.
No. Looking up public DNS records sends no mail and changes nothing. Your email keeps working exactly as it does now.
Without an enforced DMARC policy, someone can send email that appears to come from your exact domain, including fake invoices or changed banking details. Enforcement does not stop every fraud attempt, such as lookalike domains, but it closes the easiest route.
The large mailbox providers have published requirements for organizations that send email in volume, including authenticating mail with SPF and DKIM and publishing a DMARC policy. The exact thresholds are theirs to set and change, so we check your setup against their current published guidance rather than quoting numbers here.
Yes. There is no charge for the check or for the conversation about the findings, and no card details are collected. It gives us a genuine reason to introduce ourselves, and gives you something useful whether or not you become a client.
If your domain is open to spoofing, we tell you promptly and explain the safest order to fix it, because tightening DMARC too fast can block legitimate mail. Our helpdesk and Security Operations Centre are staffed 24/7.
Send the domain you use for email and we will take it from there. NetFusion Designs is SOC 2 Type 2 audited, with offices in Markham, Toronto, Kitchener, Mississauga, Pickering and Montreal.
%20(1).avif){kind=logo}
%201.avif)
