Free DMARC Checker

Check your DMARC, SPF and DKIM records in seconds.

Run the scanner first. If your domain needs work, Orbis Cloud can help configure and monitor SPF, DKIM and DMARC for £15/month.

DMARC record lookup SPF and DKIM checks Free scan

Step 1

Scan your domain

Enter your domain inside the scanner below so EasyDMARC can record the scan in its portal.

Loading domain scanner...

Step 2

Need help fixing what the scan finds?

Send us the domain after you scan it. We can set up SPF, DKIM and DMARC, then monitor changes monthly for £15/month.

Get setup help

Fix them for £15 a month.

Our engineers configure and continuously monitor SPF, DKIM and DMARC on your domain — the three records every email server checks before deciding whether to trust you. One flat fee. No setup charge.

SPF

Sender Policy Framework

We publish the exact list of servers allowed to send as your domain — so spoofers using your name get rejected before they hit an inbox.

DKIM

DomainKeys Identified Mail

We generate and rotate cryptographic keys that sign every outgoing email, proving to receiving servers it really came from you and wasn’t altered.

DMARC

Domain-based Reporting

We set policy to reject impersonators, monitor the daily reports from Google, Microsoft and Yahoo, and alert you the moment something looks off.

🛡️What you’re protected against

CEO & invoice fraud — attackers spoofing your domain to trick staff or clients into wiring money to the wrong account.
Phishing using your name — criminals sending fake “from you” emails to customers, suppliers and partners to steal credentials or payments.
Brand impersonation — lookalike senders abusing your domain’s reputation to land in inboxes.
Email deliverability failures — your real invoices, quotes and password resets silently going to spam or bouncing.
Quiet domain abuse — spammers sending through your domain without you knowing, damaging long-term sender reputation.

✓What’s included for £15/month

Full SPF, DKIM & DMARC setup on your domain — configured by a UK engineer, not a wizard.
DMARC enforcement to p=reject — actively blocking spoofed mail at Google, Microsoft, Yahoo and Apple.
DKIM key rotation kept up to current standards, so signatures stay valid as Google’s rules evolve.
Daily DMARC report monitoring — we read the reports so you don’t have to, and flag anything suspicious.
Ongoing changes covered — adding a new email tool (Mailchimp, HubSpot, Xero, etc.)? We update the records for you, no extra charge.
Alerts when something breaks — bounced mail, failed authentication or unauthorised senders trigger a notification within 24 hours.
Monthly status email — plain-English summary of who tried to spoof you, what we blocked, and your domain’s current health score.
UK-based support over email and WhatsApp — no offshore call centre, no ticket queues.

£300 typical setup £15/month

✓ No setup fee

Real costs of a misconfigured domain.

A missing DMARC reject policy or a stale SPF record isn’t a paperwork problem. It’s the open door attackers walk through. Below: three patterns we see in UK businesses every month, plus one public incident on the record.

£85,000 wired

30-person London accounting firm

An attacker spoofed the managing partner’s address and emailed the finance lead asking to redirect a client’s settlement. Without a DMARC reject policy, the spoofed mail landed straight in the inbox with no warning. The transfer cleared before anyone noticed.

What would have stopped it: DMARC p=reject — included in our £15/mo service.

3 weeks of lost mail

UK e-commerce brand, ~50 staff

They added a new email tool but never updated SPF. Half their order confirmations and password resets started landing in spam or bouncing. Customers churned, support tickets piled up, and the cause wasn’t found for nearly a month.

What would have stopped it: active SPF maintenance + DMARC reporting — we’d see the bounce in day-one reports.

£12k extortion paid

Manchester logistics SME

Phishers cloned the CEO’s domain because there was no DKIM signature to verify against. Staff received a series of urgent “invoice attached” emails leading to credential theft, then ransomware on a shared drive. The recovery cost dwarfed the ransom.

What would have stopped it: DKIM signing + DMARC p=reject — both covered.

€42 million

FACC AG — public incident, 2016

An aerospace supplier to Airbus and Boeing lost roughly €42 million to a CEO-impersonation email. The attacker used a domain spoof that proper DMARC enforcement would have caught at the receiving server. The CEO and CFO were dismissed in the aftermath.

Source: FACC AG ad-hoc disclosure, January 2016. The same attack pattern targets UK SMEs every week.