Published email records
Public SPF, DMARC and MX records. These observations do not identify every legitimate sender, verify DKIM for every service, or prove that your real messages pass authentication.
Enter your business email’s domain after the @, such as example.com. This reads published email records and selected website signals—not a complete security audit.
No password or login. Public records are checked through Cloudflare and Google; selected website checks use public pages.
Public SPF, DMARC and MX records. These observations do not identify every legitimate sender, verify DKIM for every service, or prove that your real messages pass authentication.
Selected settings on your website's main page. Other pages and forms are not tested.
Whether the main page tells browsers to keep using a secure connection. This is one setting, not a full assessment of the website.
A limited set of public pointers and file paths. An observation is a reason to review—not proof that someone accessed an account or breached the business.
A record can exist while a sender is misconfigured. An incomplete lookup is missing evidence, not a pass. Review findings with your domain administrator before changes.
Ask which observation needs review, which sender it concerns and what evidence is missing. Website findings may need a website administrator, not email setup.
A scoped setup checks the agreed sending services using representative message evidence. Those results and any unresolved checks belong in the Shield Record.
See what Shield Setup includes →