Is this the same as checking my email is secure?

No. This reads two public DNS records that control whether others can send as your domain. It says nothing about your mailbox security, your passwords, whether you have multi-factor authentication on, or whether anybody has access to your inbox.

I have SPF but not DMARC. Is that enough?

No. SPF alone tells receiving servers which servers are allowed, but without DMARC there is no instruction about what to do when a message fails, and no reporting back to you. Most receiving servers will deliver it anyway. The two work together.

Will turning DMARC on stop my own emails arriving?

It can, if you move straight to a strict policy before listing everything that sends on your behalf. Invoicing tools, booking systems and mailing platforms all send as your domain. Start on p=none, read the reports for a few weeks, then tighten. Anybody advising you to jump straight to reject has not asked what else sends your mail.

Do you store my domain?

Yes, with the result, and we say so on the form before you run it. It is kept for 90 days unless you ask for the full report, and you can ask us to delete it at any time.

Free tool

Can anyone send email as your domain?

Enter your domain and we read its published SPF and DMARC records live, then tell you what they mean. Without both, a stranger can send an email that appears to come from your address and receiving servers have nothing to check it against. The answer takes about a minute.

We read the page, its headers, its certificate and its public DNS records. We do not log in, we do not probe admin paths, and we identify ourselves in your server logs as OxwynXRay.

What this check cannot tell you

SPF and DMARC only answer one question: was this message sent by a server allowed to send as this exact domain. They have nothing to say about a domain one character different, registered last week, configured correctly and read on a phone that shows only the display name. In 2026 a business email compromise campaign passed SPF, DKIM and DMARC and still redirected an invoice payment that way. Publish the records, because leaving your own domain forgeable is indefensible when the fix is free. Then treat the rest as a process problem: verify any change of bank details by phone, on a number you already had.

What the two records actually do

SPF is a public list of the mail servers permitted to send using your domain. Your email provider gives you the line to publish. DMARC is the instruction that decides what a receiving server should do when a message fails that check, and it is the only mechanism that reports attempted forgery back to you. Neither costs anything. Both are a single DNS record.

Why a policy of p=none is not finished

DMARC has three settings. A policy of none reports failures to you and delivers the message anyway, which is the correct place to start and the wrong place to stay. Quarantine sends failures to spam. Reject refuses them. A domain sitting on none for two years is being told about forgery and doing nothing with the information.

Why your web provider is the one who should have checked

These are DNS records, and DNS is the same place your website's address lives. In most small businesses one supplier controls that panel, and that supplier is whoever built or hosts the site. It is rarely checked because it is not billable, not visible and not obviously anybody's job. Your website can be perfectly healthy while your domain is wide open.

How the fraud runs when the records are missing

It is duller than people expect, which is why it works. Somebody learns you are owed money or that you owe it, a message arrives appearing to come from you or your supplier saying bank details have changed, and the payment goes to the new account. Nothing is breached. Somebody is simply convinced, and a forged sender address is very convincing.

The long version

Anyone can send an email that looks like it came from your company

Questions

Is this the same as checking my email is secure?: No. This reads two public DNS records that control whether others can send as your domain. It says nothing about your mailbox security, your passwords, whether you have multi-factor authentication on, or whether anybody has access to your inbox.
I have SPF but not DMARC. Is that enough?: No. SPF alone tells receiving servers which servers are allowed, but without DMARC there is no instruction about what to do when a message fails, and no reporting back to you. Most receiving servers will deliver it anyway. The two work together.
Will turning DMARC on stop my own emails arriving?: It can, if you move straight to a strict policy before listing everything that sends on your behalf. Invoicing tools, booking systems and mailing platforms all send as your domain. Start on p=none, read the reports for a few weeks, then tighten. Anybody advising you to jump straight to reject has not asked what else sends your mail.
Do you store my domain?: Yes, with the result, and we say so on the form before you run it. It is kept for 90 days unless you ask for the full report, and you can ask us to delete it at any time.

This tool is one part of the full X-Ray, which measures security headers, your certificate, speed, indexability and what your site publishes about itself. Same scan, same free report.