What this email security checker tests
Email was never built to prove who sent a message, so three DNS records were added on top to close that gap. This tool reads all three for the domain you enter and tells you whether they add up to real protection or leave room for someone to send mail in your name.
SPF, which stands for Sender Policy Framework, is the list of mail servers allowed to send for your domain. When a receiving server gets a message, it checks the sending server against that list. If the server is not on it, the message fails SPF and looks suspicious.
DKIM, or DomainKeys Identified Mail, adds a cryptographic signature to each message using a private key only you hold. The matching public key lives in your DNS, so a receiver can verify the signature and confirm the message was not altered in transit and genuinely came from your domain.
DMARC, short for Domain-based Message Authentication, Reporting and Conformance, sits above both. It checks that SPF and DKIM not only pass but also align with the visible From address, tells receivers what to do when a message fails, and sends you reports showing who is sending under your name. The instruction lives in the policy tag, written as p=none, p=quarantine, or p=reject.
Why p=none is only the start
A policy of p=none asks receivers to take no action and just report back. That is the right way to begin, because the reports show you every service that sends mail for you before you start blocking anything. The catch is that spoofed mail still gets through while you are at p=none, so a domain sitting there long term is not actually defended.
The recommended path is to publish SPF, turn on DKIM, then add DMARC at p=none and read the reports until you are confident your real senders pass. From there move to p=quarantine, which routes failing mail to spam, and finally to p=reject, which tells receivers to refuse it outright. Once you reach p=reject with SPF and DKIM aligned, attackers can no longer spoof your domain in phishing emails. To dig deeper into how these records fit together with the rest of your DNS, read the DNS security guide.