No one sends email as you

We check every record that decides whether your mail is trusted, tell you when one breaks, and show you exactly what to fix.

  • $12 a year
  • Every check included
  • Score in seconds
The OmgSecure overview for northwind.com: a security score of 91, well protected, up 2 since last week, with an alert that SendGrid was added to the SPF record.

Most domains miss the basics.

Few domains publish every record that stops someone sending mail as them. We check every one of yours and tell you what to fix.

See where your domain stands
Domains passing each check
SPF
59%
DKIM
33%
DNSSEC
5%
Sources: Tranco Top 1M, APNIC Labs.

From first score to fixed for good

  1. Add your domain

    Sign up with your work email and get an instant security score for your domain, with the fixes that matter most first. Nothing to install and no DNS access: we read your public records.

    Three suggested fixes, the first highlighted: move DMARC to reject, rotate the default DKIM key, and remove two unused SPF includes.

  2. We monitor everything

    We scan every record every 12 hours, read the reports mailbox providers send about your mail, check your mail servers are set up to encrypt, and notice when a signing key disappears. Each fix you make shows up in the score.

    A score trend from Jun 30 to Sep 19 rising from 62 to 91, marked where DMARC moved to quarantine (Aug 5, +5) and DNSSEC was turned on (Sep 10, +15), with smaller gains along the way.

  3. Act on what matters

    Alerts ranked by severity and written in plain words, with suppression controls and a record of how each one was resolved.

    Two open alerts: critical, someone is sending mail as northwind-legacy.net; and high, the DKIM selector s1 disappeared from DNS. Wider screens also list a medium alert about the TLS certificate on mx2, resolved 1h ago by a scan.

All of email security, in one place

Pick an area to see every check in it and what each one looks at.

Prove who may send as you.

example.cominboxSPFDKIMDMARCARCforwardedDMARC reports

SPF record and policyYour public list of the servers allowed to send as you. Without it, anyone can claim to be you.

SPF 10-lookup limitReceivers stop reading that list after ten lookups. Past that, your real mail starts failing.

SPF void lookupsEntries that point at nothing. Two too many and strict receivers throw the whole list out.

SPF mistakesSmall mistakes in the list that receivers read differently from what you meant.

DKIM key discoveryFinds the keys your mail is signed with, so each signature can be checked against them.

DKIM key strengthShort or outdated keys can be forged. We check each key is strong enough to trust.

DKIM key rotationKeys get stolen the longer they live. We tell you when one is due for replacing.

DMARC policy and alignmentYour instruction to receivers on what to do with mail that fails: deliver, quarantine or reject.

DMARC report destinationsMakes sure your reports only go to addresses that agreed to receive them.

DMARC 2026 rulesThe 2026 rules for DMARC, including how subdomains that do not exist are treated.

DMARC aggregate reportsDaily reports from receivers, turned into a list of everyone sending as you.

DMARC failure reportsCopies of single messages that failed, so you can see exactly what went wrong.

Forwarded mailTells mailing lists and forwarding apart from forgery, so honest mail is not blamed.

Live send testSend us one email and see the exact verdict a real inbox gave it.

Signature replay protectionStops someone resending one of your real signed messages to millions of people.

DKIM2 (coming)The next version of message signing, which records every hop a message takes.

Encrypt every hop between a sender and your mail exchangers.

senderyour MXTLSMTA-STSTLSATLS-RPT

STARTTLS on every MXYour policy tells senders to encrypt, and their reports tell us when they could not.

MX certificatesEach mail server’s certificate in the public logs: issued, trusted, not about to expire.

Outdated encryption (coming)Old versions of encryption have known breaks. We flag servers that still accept them.

MTA-STSA published policy that tells senders never to deliver to you without encryption.

TLS-RPTReports from senders whose encrypted delivery to you failed, so you hear before mail goes missing.

DANEPins your certificates in signed DNS. We check the pins are signed and match a logged certificate.

RequireTLS (not planned)Whether your servers accept mail that demands encryption on every hop to its destination.

Published encryption keys (not planned)Whether your domain publishes encryption keys, so people can send you private mail.

Harden the records the whole system rests on.

example.com±MXTXTCAAPTRCNAME → gone

DNSSECSigns your DNS answers, so nobody can quietly swap in their own records.

MX recordsThe records that say where your mail goes. A mistake here means mail bounces.

DNS change alertsAn alert when a record that controls your mail changes, confirmed by a second look.

CAALimits which companies may issue security certificates for your domain.

Reverse DNSYour servers can be looked up by address and back again. Google, Yahoo and Apple require it.

Registrar lockYour domain is locked against transfer and will not lapse, the two easiest ways to lose it.

Dangling DNS and subdomain takeoverOld records pointing at services you dropped. Attackers claim them and send mail as you.

DNS hygieneWildcards that hide missing records, name servers that disagree, and records that refresh too slowly.

Put your logo in the inbox.

ExampleGmailApple

BIMI recordThe record that tells inboxes where to find your logo.

Logo and mark certificateThe logo file and the certificate that proves the logo is yours.

Gmail logo readinessEverything Gmail needs before it shows your logo next to your mail.

Apple Branded MailEverything Apple Mail needs before it shows your logo and name.

Land in the inbox at Google, Yahoo, Microsoft and Apple.

GoogleYahooMicrosoftAppleUnsubscribe

Google, Yahoo, Microsoft and Apple readinessYour domain against the sender rules each big provider enforces, one by one.

One-click unsubscribeThe unsubscribe button Gmail and Yahoo require of anyone sending in bulk.

Google Postmaster Tools (coming)Your spam rate as Gmail sees it, and whether Gmail considers you compliant.

Microsoft SNDSHow Outlook.com sees the servers you send from: volume, complaints and spam traps.

Keep your name off the lists that get mail rejected.

example.comblocklistsexamp1e.comautodiscoveropen relay220 ESMTP

Blocklist monitoringWhether your mail servers appear on the public lists receivers use to reject mail.

Lookalike domainsDomains one typo away from yours, and whether they are set up to send mail.

Open relay (coming)Whether a stranger could use your mail server to send their spam.

Mail server greeting (coming)What your mail servers say about themselves to anyone who connects.

Autodiscover exposureEmail app setup records that can leak settings or point at servers you retired.

Questions

Do I need to change my DNS records?

No. We read the records you already publish and tell you exactly what to change, and why. We never edit your DNS.

What do you have access to?

Your public DNS records, the public certificate logs for your mail servers, the DMARC reports you route to us, and any test message you send us. We never sign in to your mailboxes.

What counts as a domain?

Every domain you add, including a subdomain you send mail from, is one domain. The plan includes five, and you can add more in packs of five.

How often do you check?

Every domain is scanned every 12 hours by default, and any time you ask. An alert goes out after the scan that finds a problem; a DNS change is confirmed with a second look first.

What happens when something breaks?

You get an alert ranked by severity, written in plain words, with the record it concerns and the change that fixes it. You can quiet an alert you already know about.

Can I cancel?

Yes, any time, from Billing in the app. Your plan keeps running to the end of the year you paid for, and nothing renews.

The OmgSecure score card for northwind.com: 91, up 2 since last week, with every check passing.

Start monitoring for $12 a year

Get your score in seconds, with what to fix first.

  • Every check included
  • No DNS access needed
  • Cancel any time