Email privacy checker
Check whether an email address appears in known data breaches, and how well its domain is protected against spoofing with SPF, DKIM, DMARC, MTA-STS, DANE and blocklist checks.
- Links to Have I Been Pwned for breaches
- The address is never stored
- No signup needed
Data breaches
Enter an email to start
- AddressWaiting for inputBreaches and address type
- Mail servers—MX records
- Sender checks—SPF, DKIM and DMARC
- Transport—MTA-STS and DANE
Email privacy report
Enter an email address above to see the full report: breaches, address type, mail servers, SPF, DKIM, DMARC, MTA-STS, DANE and blocklists.
Fair-use limit: 30 checks per hour and 150 per day for each visitor IP address. This is a diagnostic report, not a guarantee that an account or domain is safe.
What an email privacy check can tell you
Two different questions sit behind one address: has it leaked, and can someone pretend to send from its domain?
A breach match is about the address, not the inbox
Have I Been Pwned collects data from known breaches. A match means the address was in a leaked database, often with a password, name or phone number. It does not mean someone is inside your mailbox, but reused passwords make that much easier.
SPF, DKIM and DMARC protect the domain
These DNS records let receiving servers check that mail claiming to come from a domain really does. They protect everyone who receives mail from that domain, not the person who owns the address. On gmail.com or outlook.com they are the provider's job, not yours.
MTA-STS and DANE protect mail in transit
Mail between servers is usually encrypted, but without these records an attacker on the network can sometimes force it back to plain text. Few domains publish them yet, so a missing record is common rather than alarming.
Address type tells you how it is used
Disposable addresses expire within minutes or days, forwarding aliases hide a real inbox, and role addresses such as info@ are shared by a team. None of these are bad in themselves, but they change what you can expect from the address.
Email security records at a glance
What each check looks for, what a good result is and the mistake we see most often.
| Record | Where it lives | What good looks like | Common mistake |
|---|---|---|---|
| SPF | A TXT record on the domain | One record that ends in -all or ~all and stays under 10 DNS lookups. | Two SPF records, or +all, which lets anyone send as the domain. |
| DKIM | A TXT record at selector._domainkey | A public key for every service that sends mail for the domain. | A newsletter or billing tool sending without its own DKIM key. |
| DMARC | A TXT record at _dmarc | p=quarantine or p=reject, with reports (rua) going to a mailbox someone reads. | Staying on p=none for years, which only monitors and blocks nothing. |
| MTA-STS | A TXT record plus a policy file on https://mta-sts. | mode: enforce, so other servers must use verified TLS to deliver mail. | A TXT record without a reachable policy file, or a policy stuck in testing. |
| DANE (TLSA) | TLSA records at _25._tcp on each mail server | Records signed with DNSSEC, so senders can verify the server certificate. | TLSA records on a zone without DNSSEC, where they are ignored. |
| DNS blocklists | Run by Spamhaus, SpamCop and others | The mail server IP addresses are not listed. | A shared or recycled server IP that was listed because of a previous user. |
How this tool works
What happens between entering an address and seeing the report.
The address is checked
We check the format, split it at the @ and convert international domain names. Internal names such as .local are refused. The address itself is never written to disk.
Public DNS is read
Through Cloudflare's DNS over HTTPS we read the domain's mail servers, SPF, DMARC, common DKIM selectors, MTA-STS and DANE records. Domain results are cached for 30 minutes.
Mail servers are checked against blocklists
The IPv4 addresses of up to four mail servers are looked up in Spamhaus ZEN and SpamCop. If a list refuses our query, the report says so instead of claiming the IP is clean.
The address is checked for breaches
Breach lookups need an API key that is not set up on this site yet, so the report links you to Have I Been Pwned to search there yourself.
You get the report
Results go straight to your browser. The address is not saved, and it is never added to the page URL.
What this tool does, and what it doesn't
A plain list, so you know exactly what to expect.
This tool does
- Send you to Have I Been Pwned for breaches
- Read SPF, DMARC, DKIM, MTA-STS and DANE records
- Check mail server IPs on Spamhaus and SpamCop
- Spot common disposable, forwarding and role addresses
- Explain each result in plain words
- Let you copy or download the report
This tool does not
- Show leaked passwords or any leaked data
- Send any email or test whether a mailbox exists
- Read your inbox, messages or attachments
- Prove that an account or domain is safe
- Store, cache or log the address you check
- Require an account
Where your data goes
The domain part of the address is looked up in public DNS through Cloudflare's DNS over HTTPS service, and the IP addresses of its mail servers are checked against the Spamhaus and SpamCop blocklists. The full address is not sent anywhere, because breach lookups are not set up on this site. The address is never stored, and domain results are cached for 30 minutes. Like any website, our server may keep normal access logs, as described in our privacy policy.
Want to fix a domain's results? DMARC.org explains SPF, DKIM and DMARC step by step.
Why your results might look unexpected
The six surprises people ask about most, and what each one means.
No breaches, but lots of spam
Spammers also guess addresses and buy lists that never appear in a public breach. A clean result only covers breaches Have I Been Pwned has loaded.
A breach from years ago
Old breaches still matter if you reused that password. If you changed it everywhere since, there is nothing more to do.
A big provider shows p=none
Some large mailbox providers keep a relaxed DMARC policy for compatibility and protect users in other ways. It matters most for business domains that send their own mail.
DKIM not found
Your provider may use a selector name we did not try. Open a message you sent, look for DKIM-Signature and its s= value to see the real selector.
Blocklists could not be checked
Spamhaus refuses queries from busy public DNS resolvers. The result means unknown, not listed. A Spamhaus DQS key on the site fixes this.
The domain cannot receive mail
There are no MX records, or a null MX that says the domain accepts no mail. Messages to this address will bounce.
Questions about email privacy checks
Where does my email address go when I run a check?
The domain part, the text after @, is looked up in public DNS through Cloudflare's DNS service, and the IP addresses of its mail servers are checked against the Spamhaus and SpamCop blocklists. The full address is sent only to Have I Been Pwned, over HTTPS, for the breach lookup. It is never stored on our server.
My email was found in a breach. What should I do?
Change the password for the breached service, and for every other account where you used the same password. Then turn on two-step verification, ideally with an authenticator app or a passkey, for your email and banking first. A password manager makes it easy to give every site its own password, so the next breach cannot spread.
Does "no breaches found" mean my email is safe?
No. It means the address is not in the breaches that Have I Been Pwned has loaded. Many leaks are never made public, and some breaches are added years after they happen. Treat it as good news, not as a guarantee, and keep using unique passwords.
What does DMARC p=none mean?
The domain publishes DMARC, but only to collect reports. Receiving servers are not asked to block or quarantine mail that fails SPF and DKIM, so the domain can still be spoofed. Once all legitimate senders pass, the owner can move to p=quarantine and then p=reject.
Why does DKIM show as not found when my mail is signed?
DKIM keys are published under a selector name that only the sender knows, such as google or selector1. This tool tries the most common selectors. If your provider uses a different one, the key exists but cannot be found from the outside, so check the DKIM-Signature header of a real message instead.
Can I check someone else's email address?
Yes, in the same way anyone can search Have I Been Pwned. The result only shows the names, dates and types of data in known breaches, never passwords or other leaked content. Please use it to protect people, for example to warn a colleague, not to target them.
Is the email address I check stored?
No. The address is not saved, cached or logged by this tool, and it is not put into the page URL. Results for the domain are cached for 30 minutes so repeat checks are faster. A hashed, temporary copy of your IP address is used for rate limiting and expires within 24 hours. Like any website, our server may keep normal access logs, as described in our privacy policy.