Email Scanner
Enter a suspicious email address or domain. We instantly check the syntax, whether it is a disposable domain and whether it is a role account. For the authentication analysis (MX, SPF, DKIM, DMARC) we query the domain public DNS records.
Instant checks
Verdict
Email Scanner
Validate an email address or domain in seconds
Want to know whether an email address is well-formed, whether it belongs to a disposable service, or whether a domain has a solid mail configuration against impersonation? Enter the address or domain in the field and we return the result in seconds. No registration, no install, and we do not keep your data.
How it works
Step 1 · Enter an address or a domain. A single field. Type a full email address (for example [email protected]) or just a domain (company.com).
Step 2 · Immediate checks in your browser. We instantly validate the syntax of the address against the standard (RFC), detect whether the domain belongs to a disposable or temporary mail service, and flag whether the address is a generic role account (info@, sales@, admin@...).
Step 3 · Domain authentication via DNS. We query the domain's public DNS records (MX, SPF, DMARC and DKIM) to assess its email authentication posture: whether it is set up to receive mail and what measures it publishes against impersonation of its own domain.
What it checks
- Address syntax (RFC). Whether the address is correctly formed according to the email standard.
- Disposable or temporary domain. Whether the domain belongs to a throwaway mail service, common in unreliable sign-ups.
- Generic role account. Whether the address is of the type
info@,sales@,support@,admin@, rather than a specific person. - MX records. Whether the domain is configured to receive mail and through which servers.
- SPF. Whether the domain publishes an SPF policy declaring which servers are authorised to send on its behalf.
- DMARC. Whether the domain publishes a DMARC policy and what level of protection (none / quarantine / reject) it declares against impersonation.
- DKIM. Whether the domain publishes a DKIM signature to validate the integrity and origin of its outbound mail.
Together this forms the domain's email authentication posture: the more complete it is (MX + SPF + DMARC + DKIM properly configured), the harder it is for an attacker to impersonate that domain.
What this tool does NOT do
To avoid confusion, this tool does not analyse the content of an email. We do not ask you to paste or forward any message. It does not examine headers, subject, body, links or attachments of a specific email, nor does it issue a verdict on whether an individual message is phishing. It works only on the address or domain you enter: its validity and the domain's public authentication configuration.
What happens to your data
A single address or domain. We only process the value you enter in the field. We do not ask for any message, header or attachment.
Immediate checks in your browser. Syntax validation, disposable-domain detection and generic-account identification run in your own browser.
DNS queries to public records. For domain authentication we query the published DNS records (MX, SPF, DMARC, DKIM), which are public information about the domain itself. We do not access any mailbox or private data.
Zero storage. We do not keep the address or domain you enter. It is not recorded in any persistent log, not indexed, not shared with third parties.
GDPR compliance. Minimum processing, purpose limited to the requested check, no unnecessary international transfers.
Results you will see
Address validity. Whether the address is well-formed according to the standard, whether the domain is disposable or temporary, and whether it is a generic role account. Three signals that help you judge how reliable a contact is before trusting it.
Domain authentication. The status of the domain's MX, SPF, DMARC and DKIM records, explained in plain language: what it has published, what it is missing, and what each piece means for protection against impersonation.
Each result comes with an explanation of what each check means. No black box: you see why we say what we say.
Who finds it useful
Individuals and self-employed who receive a contact by email and want a quick check of whether the address looks legitimate before replying or trusting it.
SMEs without a security team. Professional firms, shops, small consultancies that want to check the validity of contact addresses and, while at it, review whether their own domain has email authentication properly configured.
IT and marketing teams that want to validate the quality of an address (format, disposable, generic) and check at a glance the SPF/DMARC/DKIM configuration of a domain.
Leaders who want to self-assess their domain. Enter your own domain to see whether your organisation publishes a solid authentication posture against anyone trying to impersonate it.
Frequently asked questions
Is it really free?
Yes. Unlimited checks at no cost. If you want advanced features (bulk validation, API integration, reports), there is a managed version we can discuss, but the free tool is complete for one-off use or small teams.
Do I have to paste the email or its headers?
No. The tool does not analyse messages. You only need to enter an email address or a domain in the single field of the form.
Does it work entering only the domain?
Yes. If you enter just the domain (company.com), we run the authentication checks (MX, SPF, DMARC, DKIM). If you enter a full address, we additionally validate its syntax and check whether it is disposable or generic.
What does it mean if SPF, DMARC or DKIM is missing?
It means the domain does not publish that authentication measure, which makes it easier for an attacker to send mail impersonating that domain. Having MX, SPF, DMARC and DKIM properly configured is the foundation for protecting against impersonation.
Does checking my domain reveal anything private?
No. We only query DNS records, which are public information anyone can see. We do not access mailboxes, passwords or content.
Want something more complete?
If your organisation wants to thoroughly review the email authentication of its domains, strengthen SPF/DMARC/DKIM or validate addresses at scale, we can help: mail configuration review, support to roll out DMARC in protection mode, and contact-list validation.
Let us talk · [email protected] · Contact us