Email Security
Stop your domain being spoofed.
Typical useMake sure nobody can send email pretending to be your company — and prove it to the auditor.
Grade a domain's defences against spoofing — SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI — and get told exactly what to publish to fix it.
Free to start on every tool — no card, no time limit. You pay only for what grows beyond the free tier. Sign in with your qzila account to use it.
What it checks
- SPF syntax, lookup count and policy strength
- DKIM selectors and key length
- DMARC policy, alignment and reporting
- MTA-STS policy file and mode, TLS-RPT, BIMI logo and record
- Copy-paste DNS records for every finding
How this tool bills
Indicative prices, EUR excl. VAT. The current price list is in your account and applies from the day you add something.
Pricing examples
Three typical situations, worked through the way the invoice would show them. Prices are indicative; the current price list is in your account.
- Example 1 · Trying it out1 domain watched
A freelancer or a small company signs in and adds 1 domain watched to see what the tool finds.
Everything you add is within the free tier (1 domain watched free every month), so nothing is billed. There is no time limit — it stays free while you stay within it.
1 − 1 free = 0 × €3.00Monthly bill: €0.00 — free. - Example 2 · A small company5 domain watcheds
A company adds 5 domain watcheds — its main systems and a couple it acquired along the way.
The first 1 are covered by the free tier. The remaining 4 are billed at €3.00 each, metered per month.
5 − 1 free = 4 × €3.00Monthly bill: 4 × €3.00 = €12.00/ month. - Example 3 · An agency or a larger estate12 domain watcheds
An MSP, an auditor or a larger company watches 12 domain watcheds across several clients or business units.
The free tier still covers the first 1. The other 11 are billed at €3.00 each. Remove something mid-month and it stops counting the same day; set a budget and you are warned before you reach it.
12 − 1 free = 11 × €3.00Monthly bill: 11 × €3.00 = €33.00/ month, itemised on one invoice.
Try your own numbers
The API
Every qzila tool is a GraphQL API first; the web UI is one client of it. Anything you can do in the browser you can do from a script, a CI job or the Asign platform.
https://emailsecurity.tools.qzila.com/graphqlPOST · application/json · { "query": "…" }
Requests are authenticated with your qzila session (the same sign-in as the browser). For automation, sign in once at identity.qzila.com and reuse the session cookie; API keys for service accounts are on the roadmap.
Whatever this tool detects — a verdict flip, a regression, a change, an incident — is emitted as a signal to the qzila alert hub, which forwards it to email, Slack, a webhook, SMS or Jira, and to ServiceWatch. Each signal carries the asset it belongs to, so you can correlate it back to your own inventory (or to an Asign asset).
Main operations
auditmutationAudit a domain: SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI, with the records to publish.
mutation { audit(domain: "example.com") { grade checks { name status advice record } } }sessionHistoryqueryYour audits, newest first.
query { sessionHistory { domain grade auditedAt } }reportqueryThe stored report for one domain.
query { report(domain: "example.com") { grade checks { name status } } }
Send requests to https://emailsecurity.tools.qzila.com/graphql
Questions about Email Security
Which records are checked?
SPF, DKIM (known selectors), DMARC, MTA-STS with its policy file, TLS-RPT and BIMI — syntax, alignment, lookup limits and the effective policy, with the exact records to publish.
We use Google Workspace or Microsoft 365 — is this still needed?
Yes. The provider signs your mail, but SPF, DMARC and MTA-STS are your DNS records; without a DMARC policy at quarantine or reject anyone can still send as your domain.
Will DMARC block our own mail?
Not if you start with p=none, read the reports and add every legitimate sender to SPF/DKIM before moving to quarantine and reject. The tool tells you when you are ready to move.
How often is a watched domain re-checked?
Daily, and you are alerted when a record changes or a policy weakens.
Is the free tier a trial?
No. It stays free for as long as you stay within it — no card, no time limit. You only start paying when you add more than the free tier covers.
How am I billed?
Monthly, for what you actually had in the tool during the month, at the public price per unit. Everything lands on one invoice itemised per tool. Remove something and it stops billing the same day.
Where do alerts go?
Every tool reports through one alert hub. You choose per destination: email, Slack, a webhook, SMS or a Jira ticket — and ServiceWatch shows the same signals on one board.
Where is my data kept?
In the European Union. qzila is built and operated by adcore s.r.o., a Slovak company; the tools run on EU infrastructure.
Start with one tool. Add the rest when you need them.
Sign in once and every tool is a click away. You pay only for what you watch, per month, with no minimum and no contract — the price list is in your account before you add anything.
- One account across every qzila tool
- Free tier on every tool, then pay-as-you-go
- Alerts to email, Slack, webhook, SMS or Jira