Every email you send stands on the front line of your brand. It sets your company apart from competitors and represents what your company is all about. A handful of DNS records decide whether the world can trust that your email really came from you. Find out where you stand in about thirty seconds.
Free Email Security Check
Can a stranger send email that looks like it came from you?
For a lot of small businesses, the honest answer is "yes." Type in your domain below and see what your email records say about you. No sign-up. Nothing gets changed. It only reads public information.
Scan your domain
Enter the part of your email address after the @ sign (for example, yourcompany.com), then click Scan Now.
Got a low score? That's common, and it's usually easy to fix. Click Increase Score in the results and we'll walk you through the next step.
Why these records make or break your email
The Rules Changed
Google and Yahoo started enforcing new sender rules in 2024. Microsoft followed for Outlook.com, Hotmail, and Live in May 2025. Big senders now need SPF, DKIM, and DMARC, and Gmail began rejecting non-compliant mail in late 2025. Smaller senders still need at least SPF or DKIM to pass. Proper setup isn't a "nice to have" anymore.
When you send an email, the receiving mail server has one big question: "Is this really from who it says it's from?"
Your DNS records answer that question. They are small lines of text stored with your domain name, out where any mail server in the world can read them. If they're missing, broken, or out of date, a few bad things can happen:
- Your real emails land in spam. Invoices, quotes, and replies to customers quietly go missing.
- Criminals can pretend to be you. They send fake emails using your company name to your customers, vendors, or your own staff. A fake "please update our bank info" email is one of the most expensive scams out there.
- Your good name takes the hit. When a customer gets fooled by an email that looked like yours, they don't blame the crook. They remember your name.
The good news? Most businesses don't need new email or a new way of working. In most cases, it's a matter of getting a handful of records set up correctly and keeping an eye on them.
One exception: if your email came bundled with your website hosting, it lives on a server shared with many other businesses. When one of those sites gets hacked, the whole server can end up on a spam blacklist, and your email gets blocked along with it. If that sounds like you, it's worth a conversation. Moving is often easier than you'd think, especially if you already pay for Microsoft 365.
The four records, in plain English
Think of your email like a letter going through the mail. Here's what each record does.
SPF · Sender Policy Framework
The approved sender list
SPF is a list of the services allowed to send email for your company. That might be Microsoft 365, your billing system, and your newsletter tool. When an email shows up, the receiving server checks: "Is this sender on the list?" If not, it gets suspicious. A common problem is a list that's missing a service you added later, or one that has gotten too long to work.
DKIM · DomainKeys Identified Mail
The tamper-proof seal
DKIM puts a hidden digital signature on every email you send. The receiving server uses a key in your DNS to check that signature. If it matches, the server knows two things: the email really came from you, and nobody changed it along the way. Think of it like the seal on a medicine bottle. If the seal is broken, you don't trust what's inside.
DMARC · Domain-based Message Authentication, Reporting & Conformance
The instructions for the bouncer
SPF and DKIM do the checking. DMARC tells the receiving server what to do when an email fails those checks: let it through, send it to spam, or block it. It also sends you reports, so you can see who is sending email using your name, including people who shouldn't be. Without DMARC, a server has to guess. With DMARC set to block, fake emails using your domain get stopped at the door.
The Honest Truth About BIMI
BIMI is a marketing tool, not a security requirement. Most businesses don't need it. Showing your logo in Gmail takes a paid mark certificate, which usually runs from several hundred to around $1,500 a year. The version that adds Gmail's blue checkmark also requires a registered trademark. If you send a lot of marketing email to consumers, it can be worth it. If not, spend that money elsewhere.
BIMI · Brand Indicators for Message Identification
Your logo on the envelope
BIMI lets your company logo show up next to your name in the inbox, in Gmail, Yahoo, Apple Mail, and others. It's the one thing on this list that customers can actually see. That's why it matters most to retail brands and anyone who sends a lot of marketing email: it tells readers "this is really us" before they even open the message. No other record does that.
But there's a high bar to get in. BIMI only works after your DMARC is set to actually block or quarantine fake email. Most mail providers also require a paid certificate to show the logo. Most people have never heard of BIMI, and for most small businesses, that's fine. Get SPF, DKIM, and DMARC right first.
What your score is telling you
The scanner gives you a grade based on which records it finds and how well they're set up. Here's a simple way to read it:
- Missing records mean nobody is checking. Anyone can send email that looks like yours.
- Records that exist but have errors can be worse than nothing, because your real email might get flagged.
- DMARC set to "none" means you're watching but not blocking. That's a good first step, but it's not the finish line.
- A missing BIMI record on its own is nothing to worry about. Read the note above before spending money on it.
You don't have to figure this out alone
Why NetWerks
Veteran-owned. CISSP-credentialed. Protecting secure communications since our founder's Coast Guard days, and serving Western Massachusetts businesses for over 35 years. We're an EasyDMARC partner, so the same tool you just used is the one we use to fix and watch your records.
Most business owners never asked to become email experts. You have customers to serve and a business to run. The person who set up your email years ago may be long gone, and nobody remembers which services were ever added to the list.
That's normal, and it's exactly the kind of thing we fix. Fixing broken email records is usually simple and straightforward. The careful part is making sure every service that sends email for you is accounted for, so nothing real gets blocked along the way.
Here's how it works
1. Scan your domain. Use the free tool above to see where you stand today.
2. Have a short conversation. We learn how your business uses email and who sends it for you.
3. We fix it and keep watch. When you onboard with EasyDMARC through NetWerks, we correct your records as part of setup and keep monitoring them, so you don't have to.
Your company's name should belong to you, not to whoever wants to borrow it for a scam.
Leave it alone, and you may never know how many invoices went to spam, or how many customers got a fake email with your name on it. Get it right, and your email shows up where it should. Fake messages get stopped. And you can stop wondering.
Ready to see where you stand?
Run the free scan. If your score needs work, click Increase Score in the results, or call us at 413-786-9675 and talk to a real person.
The scanner only reads public DNS records that any mail server can already see. It doesn't log in to anything or make any changes to your domain.
