Email Security
Stop anyone sending email in your name.
Find out in seconds whether a fraudster can send a fake invoice or an email “from the boss” from your address, and what exactly to fix.
€0.05 / audit
Every account gets €5 of usage free each month, shared by all the tools. No card and no time limit: you pay only for what goes over. Sign in with your qzila account to use it.
What it does
- Finds out whether someone can send email in your name
- For every finding, says what the DNS record must contain, so you can fix it yourself or pass it to your administrator
- Checks SPF, DKIM and DMARC, which Gmail and Yahoo have required from bulk senders since 2024, so your mail does not land in spam
- Grades the protection from A+ to F, so you know at once whether all is well
How this tool bills
Today's list prices in EUR, read from the qzila price list when this page was built. You are billed monthly for what you used.
What you would pay
Enter how much you need in a month. Priced with today’s list.
Every account gets a 5 € credit each month, taken off the invoice. All the tools you use share it; the estimate assumes this is the only one.
The API
Every qzila tool is a GraphQL API first; the web UI is one client of it. Anything you can do in the browser you can do from a script, a CI job or the Asign platform.
https://emailsecurity.tools.qzila.com/graphqlPOST · application/json · { "query": "…" }
Requests are authenticated with your qzila session (the same sign-in as the browser). For automation, sign in once at identity.qzila.com and reuse the session cookie; API keys for service accounts are on the roadmap.
Whatever this tool detects — a verdict flip, a regression, a change, an incident — is emitted as a signal to the qzila alert hub, which forwards it to email, Slack, a webhook or Jira, and to Service Watch, which can also send it as an SMS. Each signal carries the asset it belongs to, so you can correlate it back to your own inventory (or to an Asign asset).
Main operations
auditmutationAudit a domain: SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI, with a finding per check.
mutation { audit(domain: "example.com") { grade checks { id title passed severity summary } } }sessionHistoryqueryYour audits, newest first.
query { sessionHistory { domain grade auditedAt } }reportqueryThe stored report for one domain.
query { report(domain: "example.com") { grade checks { name status } } }
Send requests to https://emailsecurity.tools.qzila.com/graphql
Questions about Email Security
Which records are checked?
SPF, DKIM (36 common selectors plus your own), DMARC, MTA-STS with its policy file, TLS-RPT and BIMI — syntax, alignment, lookup limits and the effective policy, and what each record must contain.
We use Google Workspace or Microsoft 365. Do we still need this?
Yes. Google or Microsoft deliver your mail, but protecting your domain is up to you. Without it anyone can send an email that looks as if it came from you.
Will it block our own mail?
No. You switch the protection on in steps: first you only watch who sends mail in your name. Once all your legitimate senders (newsletter, invoicing, CRM) are in order, you switch on blocking. The audit shows which step you are at and what comes next.
Why does our mail end up in spam?
A missing or wrong domain setup is a common reason. Gmail and Yahoo have required it since 2024. Email Security shows you what is missing and what to fix.
What is a fake invoice and how does this prevent it?
A fraudster sends your customer an invoice “from you” with a different account number. When your domain has DMARC set to block, the recipient’s mail server rejects such a mail or moves it to spam before the customer opens it.
I do not understand DNS. Can I manage this?
Yes. For every finding you see what the record must contain; you add it at your domain provider or forward it to whoever runs your website.
How is it different from Typosquat Monitor?
Email Security protects your own domain, so nobody sends mail from it. Typosquat Monitor watches the domains that only look like it.
Is the free credit a trial?
No. Every month your account gets €5 of usage free, shared by all the tools. If you stay under it, you pay nothing: no card, no time limit.
How am I billed?
Monthly, for what you actually had in the tool during the month, at the public price per unit. Everything lands on one invoice itemised per tool. Remove something and it stops billing the same day.
Where do alerts go?
Every tool reports through one alert hub. You choose per destination: email, Slack, a webhook, SMS or a Jira ticket — and Service Watch shows the same signals on one board.
Where is my data kept?
The tools run on AWS in the EU (Frankfurt), operated by adcore s.r.o., a Slovak company. A few services they rely on sit outside the EU — Stripe for card payments, Google for analytics after your consent, the threat-intelligence lookups behind Safe Check — and the privacy policy lists each one.
Start with one tool. Add more when you need them.
Sign in once and every tool is a click away. You pay monthly only for what you watch. No minimum, no contract. Prices are public on every tool.
- One account for every qzila tool
- €5 free every month, then you pay for what you use
- Alerts by email, Slack, SMS, webhook or to Jira