Hostsherlock

See the email security behind any domain, right in your browser. HostSherlock is a free Chrome extension that shows whether a domain is protected against spoofing and how healthy its email setup is: DMARC, SPF, mail provider (MX), blacklist status and more. Need to check a single address too? Do it on demand. No scraping, no tracking. What HostSherlock does: Spoofing verdict at a glance: see whether a domain is protected, partially protected, or wide open to spoofing, based on its DMARC policy. Traffic-light badge: a red/amber/green badge on the toolbar shows each site's email posture as you browse. Full infrastructure breakdown: DMARC policy, SPF (and how close it is to the 10-lookup limit), mail provider / MX, public blacklist status, and domain age. Deliverability grade: an A-to-F grade for the domain, with step-by-step fixes when you're signed in. Check an address: paste any email into the "Check address" tab for a deliverability check (syntax, domain, deliverability score). Manual entry only. Domain monitoring: get alerted when a watched domain's DMARC, SPF or MX changes (free account). Deep intelligence (Pro): deep SPF analysis with authorized senders, detected sending/marketing stack, change history, and advanced checks (BIMI, MTA-STS, TLS-RPT, DNSSEC). Who it's for: Brand & domain owners: make sure your own domain can't be spoofed and your mail actually lands. Sales & recruiting: vet a company's email setup before you reach out, and verify individual addresses on the spot. Email marketers: spot deliverability red flags (weak SPF, blacklisting, no DMARC) that hurt inbox placement and sender reputation. IT & security: audit any domain's DMARC/SPF/MX in one click, and watch important domains for changes. Developers: inspect a domain's email configuration without dig or command-line tools. How it works: Open the popup on any site and HostSherlock looks up the domain's public email records: DMARC: is spoofing enforcement in place (p=none / quarantine / reject)? SPF: is it valid, and within the DNS-lookup limit? MX / mail provider: who handles the domain's mail? Blacklist: is the domain listed on public DNSBLs? Domain age: from the WHOIS creation date only (no registrant data). For a single address, the "Check address" tab runs a deliverability check on the address you paste. Why it matters: A domain without enforced DMARC can be impersonated in phishing and spoofing attacks. Weak SPF, blacklisting, or a missing DMARC policy also hurt deliverability: legitimate mail is more likely to land in spam or bounce, which damages your sender reputation with Gmail, Outlook and Yahoo. HostSherlock makes these usually-invisible signals visible in one click, so you can spot and fix problems early. Free to use, right in your browser: HostSherlock is free, with no account required to start. A free hostsherlock.com account adds domain monitoring, the fix steps, and history. A Pro plan adds deep SPF analysis, detected stack, change history and advanced checks. Privacy: Privacy by design: HostSherlock does not scrape email addresses from the pages you visit, does not read your email, and does not track your browsing. It only looks up the domain of the page you're on and the addresses you actively submit for verification. Full details are in the privacy policy on hostsherlock.com.