Unavoidably Secure offers a free DMARC and email security check for UK dental practices, care providers and small organisations. Enter your website or email domain and see in seconds whether someone could send email pretending to be you. It reads public DNS records only, needs no email address, and touches nothing on your systems.
Run the free email security check
Prefer the detailed view? Use the free DMARC checker.
On this page
What the check looks at
The check reads the three public records that decide whether email claiming to come from your domain is trusted. The National Cyber Security Centre describes them like this:
| Record | What it does |
|---|---|
| SPF | Publishes the servers that are allowed to send email for your domain. |
| DKIM | Signs the email you send, so receivers can confirm it really came from your domain. |
| DMARC | Tells receiving mail servers what to do with email that fails SPF or DKIM checks: deliver it, send it to spam, or block it. |
These are the same public records any mail server reads when your email arrives. The check does not log in to anything, send any email, or scan your network.
There are two ways to run it. The email security check gives a quick plain-English answer on screen. The DMARC checker goes into more detail on your DMARC, SPF and DKIM records and suggests the fix. Both are free and need no sign-up.
Why it matters
If your domain has no DMARC record, or one set to monitor only (p=none), a fake email that claims to come from you is usually delivered. That is how invoice redirection fraud, fake appointment messages and phishing aimed at patients, families and staff tend to work.
Our own research shows how common the gap is. Public DNS checks run on 16 October 2026 found that:
- 90% of 3,325 dental practice websites in England could be impersonated by email (England dental benchmark).
- 83% of 1,337 healthcare websites in Yorkshire and the Humber could be impersonated, including 91% of dental practices, 83% of home care agencies and 73% of care homes (Yorkshire benchmark).
Fixing it is usually a small change to your DNS records, made by whoever manages your domain or email.
What your result means
| DMARC policy | What happens to fake email |
|---|---|
| No record | Usually delivered. Receiving servers have no instruction from you. |
| p=none (monitor only) | Usually delivered. You receive reports, but fakes are not stopped. |
| p=quarantine | Sent to spam. |
| p=reject | Blocked. |
The safe route is usually to publish a monitor-only record with a reporting address first, check that your own legitimate email (practice software, appointment reminders, newsletters) passes, and then tighten the policy. Our guide What is DMARC? explains each step, and why appointment reminders go to spam covers the most common side effect.
Who it is for
The check works for any domain, but we built it for the organisations we audit: dental practices, care homes, home care agencies, GP and other health and care providers, and small charities. These organisations send appointment reminders, invoices and messages to patients, families and staff, and they are exactly the senders a fraudster wants to imitate. If you are a practice manager or registered manager and you are not sure who looks after your domain, run the check first; the result will tell you whether there is anything to ask your IT provider or website host about.
What the check cannot tell you
An email security check looks at one part of your setup. It cannot see whether staff have multi-factor authentication on their mailboxes, whether old accounts belonging to leavers are still active, or whether your website sets cookies before consent. It also cannot tell you whether your DSPT or Cyber Essentials evidence is in order. Those are covered by the free external audit and, if you need it, the full audit. No assessment certifies compliance with any standard.
What happens next
Nothing, unless you want it to. Results appear on screen and you do not need to give an email address to see them.
If you would like a fuller picture, the next step is our free external audit. It covers email impersonation alongside encryption and certificates, known-vulnerable software and forgotten test sites, and arrives as a written report within five working days. After that, a full audit is from £950 and standards readiness for the DSPT or Cyber Essentials is from £1,500, both fixed fees quoted after a scoping call.
Want the full external picture?
Request a free external audit of your website and email. No charge, no obligation, and no access to your systems.
Request your free auditOr email support@unavoidablysecure.com
Common questions
Is the email security check free?
Yes. Both the email security check and the DMARC checker are free, need no sign-up, and show results on screen.
Do I need to give my email address?
No. You only enter your website or email domain. No email address is needed to see the result.
Does the check touch our systems?
No. It reads public DNS records only, the same information any mail server sees when your email arrives.
What DMARC policy should we have?
The aim is an enforced policy, quarantine or reject, once you have confirmed your own legitimate email passes SPF or DKIM. Most organisations start with a monitor-only record and a reporting address, then tighten it.
Will setting up DMARC stop our own emails arriving?
Not if it is done in stages. Start with monitoring, check that systems such as appointment reminders and newsletters pass, then move to quarantine or reject.
This page is general information, accurate at the time of writing (October 2026), and is not legal advice. No assessment certifies compliance with any standard. Unavoidably Secure is not a Cyber Essentials certification body. Fees are fixed and quoted after a scoping call.