Free email security tools: what each one does and when to use it

You can learn a lot about your email security without spending anything. Free tools can show whether your domain can be spoofed, why a message landed in spam, who sends mail as you, and whether your addresses have leaked. This guide lists the free tools worth using, grouped by the job they do, with what each one can and can't tell you.

The list covers iBlockSpam's own free tools and official free tools from Google, Microsoft, CISA, the UK NCSC and Have I Been Pwned. It doesn't rank commercial products. Features and eligibility are as described on each tool's own page at the time of writing (November 2026).

What free email security tools are there?

Free email security tools do five jobs: check your domain's public DNS records, build correct records, investigate a suspicious or misdelivered message, monitor your sending reputation, and watch for changes or leaks. They inform you; they don't filter mail. Filtering comes from your mailbox provider or a filtering service, and the free tools tell you whether that setup is correct.

Which free tools check your domain's email setup?

Domain checkers read your public DNS records and tell you whether they're valid. DNS (the Domain Name System) is the public directory where your domain says where its mail goes and which servers may send for it. Start here, because a broken record affects every message.

• Email Health Check. One scan of a domain's mail routing, SPF, DKIM, DMARC, MTA-STS and TLS-RPT, with a plain-English report of what passes, what needs work and what couldn't be tested.
• MX Lookup. Shows which servers accept mail for a domain, in what order, and whether those servers resolve. It flags missing MX and Null MX domains that don't accept mail.
• SPF Checker. Validates your SPF record and counts DNS lookups against the limit of 10, finding void lookups, duplicate records and redirect errors.
• DKIM Checker. Checks a DKIM public key by domain and selector, including key type and length.
• DMARC Checker. Checks your policy, subdomain policy, alignment and report addresses against RFC 9989, the current DMARC standard.
• MTA-STS Checker and BIMI Checker. Validate the optional records for enforced TLS and brand logos.
• Bulk Sender Requirements Checker. Checks the Gmail, Yahoo and Outlook.com bulk sender rules that DNS can show, with a checklist per provider.
• Microsoft 365 & Google Workspace DNS Setup Checker. Compares your records with what each platform's admin documentation asks for.

Google's free Admin Toolbox includes Check MX, which checks for common MX misconfigurations, and Dig, a web version of the Unix DNS lookup command. In the UK, the NCSC's Check your cyber security service includes an Email Security Check to "find out if your emails are vulnerable to interception or spoofing." The NCSC describes the service as designed for small businesses, charities, schools and sole traders, with "no registration."

What to look for first: a DMARC record at p=quarantine or p=reject, exactly one SPF record, and DKIM passing for every service that sends as you. If you need the concepts, read SPF vs DKIM vs DMARC.

Which free tools build email authentication records?

Record generators turn your choices into syntax you can paste into your DNS host. They save typos, which are a common cause of authentication failures.

• SPF Record Generator builds one valid SPF record from the services you use and estimates its DNS lookups.
• DMARC Record Generator builds a _dmarc record with policy, reporting and alignment settings, with notes on each.
• DKIM Key Generator creates a key pair and the TXT record for a mail server you run. Keys are generated in your browser, so the private key stays on your device.
• MTA-STS & TLS-RPT Record Generator builds the DNS records and the policy file MTA-STS needs.

Most hosted platforms (Microsoft 365, Google Workspace, newsletter tools) give you their own DKIM records. Use their values rather than generating your own. Our SPF records by provider and DKIM by provider pages list them.

Which free tools help investigate a suspicious email?

Header analyzers read the hidden lines at the top of every message, which record each server it passed through and the authentication results. They're the fastest way to tell whether an email that claims to be from your bank or your boss really is.

• Email Header Analyzer shows SPF, DKIM and DMARC results, the Received hop chain and delays. It runs in your browser; nothing is uploaded.
• Microsoft 365 Spam Header Decoder explains the SFV, CAT, SCL, BCL and compauth codes Microsoft 365 adds, so you can see why a message went to Junk or quarantine. It also runs in your browser.
• Messageheader in Google's Admin Toolbox analyzes headers to find causes of delivery delays, misconfigured servers and mail-routing problems.
• SMTP Error Code Lookup explains a bounce code such as 550 5.7.26 in plain English, with likely causes and fixes.

An example of the header line to look for (sample values):

Authentication-Results: mx.example.net;
  spf=pass smtp.mailfrom=billing.example.com;
  dkim=pass header.d=example.com;
  dmarc=pass header.from=example.com

All three passing for the domain in the From address means the message really came from a server that domain authorizes. It doesn't mean the sender is honest, because a compromised account passes too. Our guides on how to read email headers and how to check if a link is safe cover the rest.

Microsoft's free Remote Connectivity Analyzer runs connection tests from outside your network. Its Inbound SMTP Email test "walks through the steps an internet email server uses to send inbound SMTP email to your domain," and its Outbound SMTP Email test "checks your outbound IP address for certain requirements," including reverse DNS and blocklist (RBL) checks.

To test a real message rather than DNS, the Email Deliverability Test gives you a one-time code; you send one email and see its SPF, DKIM and DMARC results, reverse DNS, blocklists, TLS and our spam filter's verdict.

Which free tools monitor your sending reputation?

Sending reputation is how mailbox providers judge the mail coming from your domain and servers, based on complaints, authentication and past behavior. Poor reputation sends your invoices to spam.

• Google Postmaster Tools (postmaster.google.com) shows spam rate, reputation, message authentication and delivery errors for mail you send to personal Gmail accounts, once you verify your domain. Google says the data helps you meet Gmail's requirements for sending to personal Gmail accounts (Postmaster Tools help). Our Postmaster Tools guide walks through setup.
• Microsoft SNDS (Smart Network Data Services) gives Outlook.com's view of IP addresses you own. Microsoft calls it "a free service that provides high-level insight on how users are rating the email they receive and the health of your IP space" (Outlook.com Postmaster). It only covers IPs you can prove you control, so it rarely applies if you send only through Microsoft 365 or Google Workspace. See Outlook.com deliverability, SNDS and JMRP.
• Blacklist Checker checks an IP or your mail servers against public blocklists. Lists that refuse public-resolver lookups, such as Spamhaus, are shown as "not tested" with a link, never as clean.
• Reverse DNS (PTR) Lookup checks that a sending server's IP has a PTR record that points back to the same address.

Which free tools read DMARC and TLS reports?

DMARC aggregate reports are daily XML files that receiving providers send to the address in your DMARC record, listing every server that sent mail as your domain and whether it passed. They're the evidence you need before moving DMARC to p=reject.

• DMARC Report Analyzer opens .xml, .gz and .zip reports and shows every source sending as your domain, what passes and what fails. It runs in your browser.
• TLS-RPT Report Analyzer opens TLS reports to show successful and failed encrypted connections to your mail servers, and why they failed.

Our guide to how to read DMARC reports explains what you'll see.

Which free tools watch for changes and leaks?

Monitoring tools check on a schedule and alert you, so you find problems before customers do.

• Free Domain Watch checks one domain's public MX, SPF, DMARC and MTA-STS records every week and emails you when they change, with a short monthly report. It's free with no account, one domain per email address, and it watches public DNS only; it isn't filtering.
• Lookalike Domain Generator lists typo and look-alike versions of your domain and shows which exist in DNS or have a mail server, the raw material for lookalike domain phishing.
• Have I Been Pwned shows whether an address appears in known data breaches. After you verify that you control a domain, its domain search lists the domain's breached addresses. Its FAQ says "larger domains normally require a subscription in order to see the search results." If an address shows up, follow what to do if your email is in a data breach.

What free government cybersecurity resources cover email?

Government agencies offer free services that complement email tools. In the US, CISA's Cyber Hygiene services include vulnerability scanning of public, static IPv4 addresses and web application scanning. CISA says US-based federal, state, local, tribal and territorial governments and "public and private sector critical infrastructure organizations are welcome to enroll." CISA also keeps a list of free cybersecurity services and tools from itself and other organizations, with the note that "CISA does not endorse any commercial product or service."

In the UK, the NCSC's Check your cyber security service, described above, is the most direct free email check for small organisations.

What can't free email security tools do?

Free checking tools can't stop a phishing email reaching an inbox. They read DNS, headers and reports; they don't sit in your mail flow. An MX lookup can't prove mail is filtered, and a clean DMARC record doesn't stop a criminal emailing your staff from a lookalike domain or a hacked supplier account.

Your free protection actually lives in your mailbox provider. Microsoft 365 and Google Workspace both include spam, phishing and malware filtering; make sure it's switched on and set sensibly. Our guides on Microsoft 365 preset security policies and Gmail spam settings for Google Workspace cover that. When free filtering stops being enough, free vs paid spam filters sets out the trade-offs.

A free monthly email security routine

Use the free tools on a schedule rather than only when something breaks:

1. Run the Email Health Check on every domain you own, including parked ones, and fix anything new.
2. Open the last month's DMARC reports in the DMARC Report Analyzer and investigate any source you don't recognize.
3. Check Google Postmaster Tools for spam rate and delivery errors if you send to Gmail users.
4. Run the Blacklist Checker on your sending servers if you run your own.
5. Check the Lookalike Domain Generator for newly registered look-alikes with mail servers.
6. Search Have I Been Pwned for your domain or key addresses.
7. Review your mailbox provider's filtering policies and quarantine, since that's where your actual protection is.
8. Sign up for Free Domain Watch once, so DNS changes reach you between checks.

Next steps

• Start with the free Email Health Check on your main domain; it takes one scan and tells you what to fix first.
• Turn on Free Domain Watch for weekly change alerts.
• Bookmark the Email Header Analyzer for the next suspicious message.
• If you want checks like these alongside inbound filtering, quarantine digests and daily lookalike alerts, compare iBlockSpam's plans on the pricing page. The free tools stay free either way.

Browse more guides on choosing email security.