Can someone send email as your company?
Enter your domain. In seconds you get an A+ to F grade from the same public records attackers and mail providers read: your email authentication, your DNS and your website’s security headers.
- Public records only
- No port scans, nothing installed
- No sign-up to see your grade
What you will see
- A grade from A+ to F, and a plain answer on whether your name can be borrowed
- Every check across email, DNS and your website, with what it means in plain English
- The full report with the fixes, as a PDF, if you want it
Three things a stranger can read about your domain.
Nothing here needs access to your network. These records are published for the whole internet, which is exactly why they are the first thing an attacker reads.
Email impersonation
Can someone send email as you?
- SPF: the list of servers allowed to send as your domain, and what happens to the rest
- DMARC: whether receivers are told to reject, quarantine or just watch mail that fakes you
- DKIM: whether signing keys are published under the usual names
- MTA-STS and TLS reporting: whether mail on its way to you can be downgraded unseen
DNS integrity
Can your DNS answers be forged, or a certificate issued behind your back?
- DNSSEC: whether your DNS answers are signed
- CAA: which certificate authorities may issue certificates for you
- Name servers: whether more than one answers for your domain
Website front door
What does your public site tell browsers to enforce?
- HTTPS, and whether plain HTTP is redirected to it
- HSTS, a Content Security Policy and clickjacking protection
- Software versions announced in response headers
- A security.txt, so a researcher knows where to report a problem
One rule matters more than the rest.
While your DMARC policy does not tell receivers to act on fake mail, your grade cannot be better than C, however good everything else is. That one record decides whether your name can be borrowed.
A check that does not apply is left out, not marked down. A domain with no website is graded on email and DNS alone. And where something cannot be confirmed from outside, the report says so instead of guessing.
A good grade means your public records are in order. It is not a penetration test, and it cannot see your firewall, your endpoints or your cloud configuration.
- A+Receivers are told to reject mail that fakes you, and nearly everything else is in place.
- AStrong. A few small things to tidy, or a DMARC policy at quarantine rather than reject.
- BThe important protections are on. Several worthwhile improvements remain.
- CReal gaps. This is also the best grade available while your DMARC policy is not enforced.
- DLittle stands between your name and someone borrowing it.
- FAlmost nothing is published. Start with the first item in the report.
This is what a stranger sees. The rest takes someone looking from inside.
Each of these is run by a senior BlackHawk Data engineer, at no cost, and the findings are yours to keep.
Running on Cloudflare? CloudSight is the inside view of your Cloudflare configuration: a continuous audit with the same A+ to F scoring, for the settings no outside check can read.
What people ask about the check
What does the Domain Security Check look at?
Three things a stranger can read about any domain. First, your email authentication records (SPF, DKIM, DMARC, MTA-STS), which decide whether someone else can send email in your name. Second, your DNS: whether its answers are signed with DNSSEC, which certificate authorities may issue certificates for you, and how many name servers answer. Third, the security instructions your public website gives to browsers, such as HTTPS enforcement and a Content Security Policy.
Is this a scan of my network?
No. It reads public DNS records and visits your public home page once, the way any mail server or browser does. There are no port scans, no login attempts and no probing, and nothing is installed. It cannot see inside your network, and it does not try to.
Can someone really send email as my company?
Email was designed without any check on who the sender says they are. SPF, DKIM and DMARC were added later so a domain can say which servers may send as it and what receivers should do with everything else. Until your DMARC policy is set to quarantine or reject, a receiving mail server has no instruction to refuse a message that puts your domain in the From line. That is how a fake invoice or a note "from the CEO" gets delivered.
Why does DMARC matter now?
Because the large mailbox providers now require it. Google and Yahoo have required SPF, DKIM and DMARC since February 2024 from anyone sending them more than 5,000 messages a day, and Microsoft has done the same for Outlook.com, Hotmail.com and Live.com since May 2025. Mail from domains without those records is increasingly sent to junk or refused, so the records that stop impersonation are also what keep your own mail delivered.
My grade is low. Should I set DMARC to reject today?
No. Going straight to reject can block your own mail: invoices from your billing system, alerts from your applications, messages from your marketing platform. Start with a monitoring policy (p=none) and a report address, use the reports to find every system that sends as you, fix SPF and DKIM for each one, then move to quarantine and finally reject. The report lists the steps in order, and an engineer can run it with you as a short project.
Why does DKIM say "not confirmed" instead of pass or fail?
A DKIM key can be published under any name, called a selector, and there is no public list of the selectors a domain uses. The check tries the names the large mail platforms use by default. If one answers, DKIM is confirmed. If none does, that does not mean your mail is unsigned, so it is reported as not confirmed and left out of the grade. Your DMARC reports show whether signing works.
How is the grade worked out?
Email impersonation is half the grade, the website's security headers are 30 percent and DNS integrity is 20 percent. A check that does not apply is left out rather than marked down: a domain with no website is graded on email and DNS alone. Two rules sit on top. While your DMARC policy does not tell receivers to act on fake mail, the grade cannot be better than C, however good the rest is. And A+ is reserved for a DMARC policy at reject.
Does a good grade mean we are secure?
No. It means the records a stranger can read are in order on the day of the check. It says nothing about your firewall rules, your endpoints, your cloud configuration, your backups or your people. Those need someone looking from the inside, which is what our engineer-run assessments are for.
Can I check a domain I do not own?
Yes. Everything the check reads is published for the whole internet to read, and every mail server and browser reads the same records every day. People use it on suppliers, on acquisition targets, and on the look-alike domains they have registered to protect their brand.
What do you do with the domain I enter?
It is used to run the check, and the result is held for ten minutes so a repeat is instant. The domain is not sent to analytics. We learn which domain was checked only if you ask for the report with your email address, and that goes to our engineers, not to a mailing list.
Rather have an engineer read it with you?
Twenty minutes with a senior engineer, not a sales rep. Bring your report, or just your domain.