Send your email through the gates.
Mint a private address, send it a real message, and watch SPF, DKIM, and DMARC judge it live. Leave with a sealed record of exactly where your domain stands.
A real inspection runs the moment your test email arrives.
Every test ends in a sealed record.
The inspection resolves into an Authentication Record: a graded seal swept to your real score, the SPF, DKIM, and DMARC evidence, and the provenance of the message we actually received.
- A grade that means something. The letter is capped by DMARC enforcement, the thing that actually stops spoofing, not a checklist of boxes.
- Evidence, not vibes. Every verdict is read from the live message: alignment, signing key strength, the receiving network, ARC.
- Yours to keep. Download the record as an image, share a link that hides your domain by default, or put it on the Wall.
Three steps, about a minute.
No signup, no DNS access, no configuration. The lab reads what a real receiver saw.
- 01
Get a private address
The lab mints a one-time test address the moment you arrive. Copy it, or scan the QR code from your phone.
- 02
Send it any email
From the account you care about: your work address, your newsletter tool, your CRM. Any message will do.
- 03
Watch the live inspection
The gates light up as SPF, DKIM, and DMARC are judged, then the record seals with your grade and the fixes that raise it.
A grade with teeth.
Plenty of domains pass SPF and DKIM and still get spoofed daily. The AuthGrade caps at B until DMARC starts enforcing, because until it does, passing checks protect nobody.
- A+The top lockEnforced DMARC, aligned SPF and DKIM, a strong signing key. Nobody can send mail as you.
- AEnforced, one thing to tidyProtected, but a weaker key or SPF-only alignment holds back the plus.
- A-Quarantine, not rejectSuspicious mail is set aside, but p=quarantine stops short of the full reject lock.
- BSet up, not enforcedEverything authenticates, yet DMARC is monitor-only, so spoofed mail still lands.
- CPartial protectionSomething passes, but nothing aligns to the visible From domain.
- DSpoofable right nowAuthentication records exist, but nothing passes and aligns, so a forger could send as this From today.
- FNo usable authenticationGmail, Yahoo, and Microsoft would reject or junk this mail.
More ways to look.
Know exactly where you stand.
One real message tells you whether your domain is locked down or wide open. It costs nothing to find out.
Test an emailEmailAuthLab is a free tool built by TrustYourInbox. No account, credit card, or sales call is required to get a result.