Domain security check
Can someone send email as your business?
Type your business domain, the part after the @ in your email address. We read the settings it publishes to the rest of the internet and explain each one in plain English, with what to ask whoever looks after your email.
What the results mean
Every check gets one of four results. There is no overall score: each setting does a different job, and a number out of 100 would suggest a precision a public check cannot have.
- Good
- Set up the way it should be.
- Needs attention
- Present, but not doing its job fully yet.
- Missing
- Not set up at all.
- Unable to determine
- Cannot be judged from outside. The card says how to check it yourself.
What a public check cannot see
These settings deal with one kind of fake email: a message that uses your exact address. They do nothing about a lookalike domain one letter away from yours, a stranger using your business name as the display name on a Gmail account, or a criminal sending from your real mailbox with a stolen password. All three pass every check on this page.
It also cannot see how your mailboxes are protected, who has admin rights, or whether staff verify a change of bank details by phone. The one-page checklist covers those, and is written to be handed to your IT provider.
This is not a penetration test or a full security assessment. It reads what your domain publishes, on the day you run it.
Want a person to look at it?
dotbm will review your domain's public settings for free and write it up so you can hand it to whoever looks after your email. Your existing provider can fix anything it finds.