Free tool · No signup
Can someone send email pretending to be you?
Check your domain's SPF, DKIM and DMARC in seconds. The same checks attackers run before an invoice-fraud or CEO-impersonation campaign.
We only read public DNS records. Nothing is stored unless you ask for the full report.
Frequently asked questions
What does the Wixtu email security checker test?
It reads a domain’s public DNS live and checks SPF (the record, its full include tree, the 10 DNS-lookup and 2 void-lookup limits, loops and duplicate includes), DMARC (policy, percentage, subdomain policy and whether external report addresses are authorized), DKIM (24 common selectors including Microsoft 365 selector1 and selector2, or your own, with key type and size), MX records, IP blacklists and MTA-STS, TLS-RPT and BIMI. The result is an A-F grade plus a full technical report.
What is SPF and why does the 10-lookup limit matter?
SPF is a DNS record listing the servers allowed to send email for your domain. Each include, a, mx, ptr, exists and redirect costs a DNS lookup, nested includes count too, and receivers stop at 10. Above that, SPF returns a permanent error and fails for all of your mail, including legitimate mail.
What is DMARC and which policy should I use?
DMARC tells receiving servers what to do with mail that fails SPF and DKIM alignment for your domain: deliver it (p=none), send it to spam (p=quarantine) or reject it (p=reject). The safe path is to start with p=none and a reporting address (rua), use the reports to find every legitimate sender, then move to quarantine and finally reject.
Why might the checker not find my DKIM key?
DNS has no way to list DKIM selectors, so any checker has to try likely names. If your provider uses a custom selector (Google, for example, rotates date-based ones), enter it in the DKIM section and it is checked directly. For Microsoft 365 the selectors are always selector1 and selector2, so a missing key there means DKIM is not enabled for your domain.
How do I enable DKIM for my domain in Microsoft 365?
In the Microsoft Defender portal, open Email authentication settings, select DKIM and your domain, publish the two CNAME records it shows (selector1._domainkey and selector2._domainkey) at your DNS provider, then enable signing. Until then, Microsoft 365 signs your mail with your onmicrosoft.com domain, which DMARC cannot use for your own domain.
Why doesn’t the checker include Spamhaus?
Spamhaus refuses queries coming from public DNS resolvers and answers with codes that many tools misread as a listing. Rather than show a false result, the checker leaves it out and links to Spamhaus’ own lookup. Every blacklist it does use is verified against its own test entry first, so a list that doesn’t answer properly is shown as unavailable, never as clean.
Is it safe to scan my domain?
Yes. The checker only reads public DNS records that anyone on the internet can see. It does not connect to your mail servers or systems, and Wixtu does not keep a database of scanned domains.