What does SPFWise actually check?

Every check is live: a full SPF analysis (recursive include expansion and the 10-lookup limit), a full DMARC policy review, DKIM discovery across common selectors, MX, DNSSEC (chain, algorithm and signature-expiry validation), BIMI, MTA-STS, TLS-RPT, and public blocklist checks.

Do I need an account?

No. Scanning a domain is free and needs nothing from you. Accounts are for saving domains, continuous monitoring and reports.

How is the grade calculated?

We start at 100 and subtract points for missing or risky records, weighted by how much each one affects deliverability and spoofing risk. The result maps to a grade from A+ to F.

Do you store my domain data?

Public DNS records are read live at scan time. We only keep a scan when you choose to save a domain to your account.

Why does DMARC matter so much?

Without an enforced DMARC policy, anyone can send mail that looks like it comes from your domain, and mailbox providers have less reason to trust you. DMARC is what turns your SPF and DKIM setup into real protection.

Free domain scan

Inbox or spam is decided before you press send.

Three DNS records tell every mail server whether to trust you: SPF, DKIM and DMARC. Scan your domain to get a grade from A+ to F and the exact records to fix.

No account needed
Results in 20 seconds
Exact fixes included

We scanned 107 major brands. 1 in 8 could be spoofed. Read the study

yourstore.comSample report

A+

96 / 100

Domain health

Scanned just now

SPFAll senders authorizedPass

DKIM2048-bit key, 2 selectorsPass

DMARCEnforced with p=rejectPass

MTA-STSTLS enforced inboundPass

;; 4 checks passed, 0 records to fix

Every failing row comes with the exact DNS record to publish.

What the scan reads

Three records decide your reputation.

Every receiving server looks these up in your DNS before it reads a word you wrote. The scan grades all of them in one pass.

SPF

v=spf1 include:_spf.google.com ~all

Lists every server allowed to send mail for your domain.

Miss one sender and that mail quietly fails.

DKIM

s1._domainkey IN TXT "v=DKIM1; k=rsa"

A cryptographic signature that proves your mail was not altered.

Weak or missing keys erode trust with Gmail and Microsoft.

DMARC

_dmarc IN TXT "v=DMARC1; p=reject"

Your public policy for mail that fails the other two checks.

Without enforcement, anyone can send email as you.

Plus seven more checks

MX BIMI MTA-STS TLS-RPT DNSSEC DNSBL

The supporting records that shape where your mail lands.

Small gaps here are the difference between an A and an A+.

How it works

From unknown to fixed in one sitting.

01
Scan
Type your domain. We read your live public DNS. Nothing to install, nothing to prove.
yourstore.com
02
Grade
Ten checks scored A+ to F, with every deduction explained in plain language.
03
Fix
Copy the corrected record we generate and paste it at your DNS host. Rescan to confirm.
v=DMARC1; p=reject;Copy

Measured, not claimed

Most domains fail at least one check.

We scan the public DNS of well known brands and publish what we find.

Read the global study Read the Poland edition

1 in 8

of 107 major global brands can be spoofed outright

34%

of those brands stop short of enforcing DMARC

27%

of Poland's biggest companies are spoofable

From our July 2026 scans of public DNS records.

After the fix

Records drift. Someone should notice.

An ESP gets added, a key rotates, an intern edits the zone. SPFWise watches your domain, ingests your DMARC reports and flags trouble before deliverability pays for it.

Every feature is free during beta.

DMARC reports

Every server sending as you, legitimate or not, on one timeline.

Alerts

Slack, webhook or email the moment a record breaks.

Autopilot

A guided path from p=none to p=reject without losing real mail.

Brand protection

Lookalike domains spotted before your customers meet them.

Pricing

Start free. Upgrade when you want eyes on it around the clock.

Checks are free for everyone. Paid plans add continuous monitoring, DMARC report parsing and alerts.

During beta, every plan is free. The prices below are what they will cost when beta ends.

Free

For a quick, honest audit.

$0/mo

Unlimited domain scans
Full grade and findings
The exact record to fix
No account required

Scan a domain

Pro

Agency

For managing many domains and clients.

$299/mo

Everything in Pro
Unlimited domains
Client workspaces
Team access and roles

Launch pricing and may change once beta ends.

FAQ

Questions, answered plainly

What does SPFWise actually check?: Every check is live: a full SPF analysis (recursive include expansion and the 10-lookup limit), a full DMARC policy review, DKIM discovery across common selectors, MX, DNSSEC (chain, algorithm and signature-expiry validation), BIMI, MTA-STS, TLS-RPT, and public blocklist checks.
Do I need an account?: No. Scanning a domain is free and needs nothing from you. Accounts are for saving domains, continuous monitoring and reports.
How is the grade calculated?: We start at 100 and subtract points for missing or risky records, weighted by how much each one affects deliverability and spoofing risk. The result maps to a grade from A+ to F.
Do you store my domain data?: Public DNS records are read live at scan time. We only keep a scan when you choose to save a domain to your account.
Why does DMARC matter so much?: Without an enforced DMARC policy, anyone can send mail that looks like it comes from your domain, and mailbox providers have less reason to trust you. DMARC is what turns your SPF and DKIM setup into real protection.

Twenty seconds to a verdict.

Scan your domain and see exactly where you stand.

Scan your domain