Email Security Check
DMARC, SPF and DKIM checker: can your domain be spoofed?
Checks a domain's full email authentication setup in one go: MX, SPF with a recursive 10-lookup count, DMARC policy and reporting, DKIM on 50 common selectors plus a custom one, MTA-STS including the policy file, TLS-RPT and BIMI. It gives a grade from A to F, a clear 'can be spoofed' verdict and example records, plus a DMARC record generator.
- Stage
- Live, free
- URL
- dmarc.fullstackpartner.com
- Revenue
- Planned DMARC report monitoring
- Price
- Free check; monitoring planned from 149 kr a month
- Audience
- SMB IT, agencies, MSPs
- Stack
- Static HTML/JS · PHP 8.5 · nginx
The problem
- Most small company domains can be spoofed in invoice and CEO fraud.
- Gmail and Yahoo require SPF, DKIM and DMARC for bulk senders since 2024.
- DMARC reports are XML that nobody reads.
The product
A free, instant checker with plain-English fixes and five landing pages (DMARC, SPF, DKIM, generator, MTA-STS), designed as the top of a funnel for a paid DMARC report monitoring service.
- Enter a domain or email address.
- Read the grade and fix the failed checks with the example records.
- Use the generator, then re-check with the shareable result link.
Who pays and why
Business model
| Revenue line | Price | Notes |
|---|---|---|
| Free | 0 kr | Unlimited checks and generator. |
| Monitor (planned) | 149 kr a month per domain | Receive and parse DMARC reports, alerts on new senders and failures. |
Market and targets
DMARC monitoring is a proven paid market (dmarcian, Valimail, EasyDMARC, PowerDMARC). Free checkers are their main lead source, and Danish and Nordic SMBs are underserved.
The tools are free and stay free. Revenue comes from paid add-ons and from leads for the paid security suite. Targets are planning assumptions.
Go-to-market
Launch
- Live checker and generator (done)
- Search Console
Monitor
- rua mailbox and XML parser
- Weekly summary email
- Payments
Partners
- MSP multi-domain plan
Channels
| Organic search | dmarc checker, spf checker, dkim checker. |
|---|---|
| SiteSentry | Website scans already flag missing SPF and DMARC. |
Competition
| Alternative today | Why we win |
|---|---|
| MXToolbox, dmarcian, EasyDMARC | Strong brands; we are faster, cleaner and plain-English. |
| Google Admin toolbox | Free but technical. |
What we measure
- Checks per month
- Share of domains at p=none or missing
- Monitor signups
Status and roadmap
- SPF parser with recursive lookup and void-lookup counting
- DMARC tag parsing with policy, pct, sp and rua checks
- DKIM probe of 50 selectors with key size from the public key
- MTA-STS policy fetch with SSRF-safe HTTPS client, TLS-RPT, BIMI, null MX advice
- DMARC record generator and shareable result links
- Own subdomain with Let's Encrypt, strict CSP, HSTS, no cookies, no analytics
- SEO: unique title, description, FAQPage and WebApplication schema, sitemap and Open Graph card per page
- Installable PWA with offline support
- Cross links between all five free tools and SiteSentry
- End-to-end browser test of every page and flow
- DMARC report monitoring
- Danish version
- Bulk check for MSPs
Risks
| Risk | How we handle it |
|---|---|
| DKIM selectors are not discoverable | We test 50 common ones and explain how to find the real one. |
| Competitive SEO | Five focused pages and a clear spoofing verdict. |
Want a product like this?
We build version one of products like Email Security Check from about $3,000: web app, admin panel, mobile app and API, live on your own domain. Then we can host and maintain it for $500 a month.