Free tool · #2
Email Spoof Check
Type your company's domain. We read the three DNS records that stop strangers sending email as you (SPF, DKIM and DMARC) and tell you, in plain English, how easy you are to fake.
Why it matters
Fake invoices and “change of bank details” emails work best when they come from your real address. These three records are how inboxes spot the fakes.
What we check
Public DNS records only: SPF, DMARC, DKIM on the common selector names, and your mail servers. Nothing is sent to anyone, and nothing is stored but the domain and the grade.
Got a bad grade?
Start with DMARC at p=none so you get reports without blocking anything. After two weeks, move to quarantine, then reject. We show the exact records to add.
DKIM shows as missing?
DKIM records live under a name your email provider picks. We try the common ones; if yours is custom, your provider's admin page will show it.