Free tool · Email Spoofing Checker

Can someone send email pretending to be you?

Enter your domain to check the records that stop fakes: SPF, DKIM and DMARC, plus the settings that protect email on its way to you. You'll get a plain-English answer, a score out of 100 and a fix for every gap.

Check a domain Read the guide

Free
8 checks
About 5 seconds
No sign-up

The checker

Check a domain in seconds.

The checker reads your domain's public DNS records, the same ones every mail server checks. It never sends an email.

Your result

Your email spoofing check

Can someone send email pretending to be you?

Score
DMARC policy
DKIM
Incoming email

Your SPF record

Check by check

Fixes first, then improvements, then passes.

Want a plan to get to p=reject?

Send us your result and we'll reply personally with the order we'd fix things in, so your real email keeps landing while fakes get blocked. Free, with no obligation.

This is an automated check of public DNS records, not a security audit. If someone is already sending fake email as your business, tell your email provider and warn your customers.

The guide

Can someone send email pretending to be my business?

Yes, unless your domain has a DMARC policy set to quarantine or reject. Email doesn't check who the sender is by default, so anyone can put your address in the From line. SPF, DKIM and DMARC are the DNS records that let receiving servers spot and stop those fakes.

Spoofed email is how many invoice scams start: a customer or supplier gets an email that appears to come from you, asking them to pay into a new bank account. The NCSC's email security and anti-spoofing guidance recommends all three records, with DMARC telling receivers that untrusted email should be discarded.

Why it matters

Phishing was the most common type of attack on UK businesses, experienced by 38% of businesses in the last 12 months, according to the government's Cyber Security Breaches Survey 2025/26.
The same survey found 43% of businesses reported a breach or attack of any kind over the year.
Since February 2024, Google's email sender guidelines require everyone sending to Gmail accounts to set up SPF or DKIM, and anyone sending 5,000 or more messages a day to set up SPF, DKIM and DMARC.

Google accepts a DMARC policy of none for bulk senders. That gets your email delivered, but it doesn't stop anyone spoofing you. Protection comes from quarantine or reject.

SPF, DKIM and DMARC explained

The three email authentication records
Record	Where it lives	What it does	Example
SPF	A TXT record on your domain	Lists the servers allowed to send email for your domain.	`v=spf1 include:_spf.google.com ~all`
DKIM	A TXT record at `selector._domainkey`	Publishes the key receivers use to check each email's digital signature.	`v=DKIM1; k=rsa; p=MIIBIjANBg...`
DMARC	A TXT record at `_dmarc`	Tells receivers what to do when SPF and DKIM don't confirm the email is yours, and where to send reports.	`v=DMARC1; p=reject; rua=mailto:dmarc@example.com`

DMARC is what makes the other two count. It checks that the domain people see in the From line matches the domain SPF or DKIM verified. Without it, a fake can pass SPF using the attacker's own domain behind the scenes while showing yours.

What the checker looks at

The checker runs eight checks in three groups, worth 100 points in total. It reads your DNS records only, so it can't see whether a particular email passed; your DMARC reports show that.

DMARC

30 points
DMARC policy

Whether your domain publishes a DMARC record, and what it tells receiving servers to do with email that fails SPF and DKIM: nothing (p=none), send it to spam (p=quarantine) or refuse it (p=reject). Only quarantine and reject stop fakes reaching people.

How to fix: Start with v=DMARC1; p=none; rua=mailto:you@yourdomain, read the reports for a few weeks until every real sender passes, then move to p=quarantine and finally p=reject.
5 points
DMARC reports

Whether your DMARC record asks for aggregate reports (rua=), which show every server sending email as your domain and whether it passed.

How to fix: Add rua=mailto: with an address you check, or a DMARC reporting service, to your DMARC record.
5 points
Subdomain protection

Whether your DMARC policy also covers subdomains, such as invoices.yourdomain.com. They follow your main policy unless an sp= tag says otherwise.

How to fix: Make sure your main policy is quarantine or reject, and don't set sp=none unless you have a reason to.

SPF and DKIM

20 points
SPF record

Whether your domain has exactly one SPF record listing the servers allowed to send its email, and how it treats everything else. -all and ~all are fine. +all lets anyone send as you.

How to fix: Publish one TXT record starting v=spf1 that includes every service that sends your email, ending in ~all or -all. Merge duplicate records into one.
10 points
SPF lookup limit

How many DNS lookups your SPF record needs, counting every include, a, mx, ptr, exists and redirect, including those inside other services' records. Over 10 and SPF fails for every email.

How to fix: Remove includes for services you no longer use, replace a and mx with the IP addresses they point to, and ask providers for a lighter include if they have one.
20 points
DKIM signing

Whether we can find a DKIM public key on 24 common selectors, such as google for Google Workspace and selector1 for Microsoft 365. DKIM signs each email so receivers can check it really came from you.

How to fix: Turn on DKIM signing in your email provider's admin settings and publish the record it gives you. Do the same for every service that sends email as your domain, such as your newsletter tool and CRM.

Receiving

5 points
MTA-STS

Whether your domain publishes an MTA-STS record, which tells other mail servers to only deliver email to you over an encrypted, verified connection.

How to fix: Publish an MTA-STS policy file and a _mta-sts TXT record. Google Workspace and Microsoft 365 both document how; start in testing mode.
5 points
TLS reporting

Whether your domain publishes a TLS-RPT record, which asks other mail servers to report problems delivering email to you securely.

How to fix: Add a TXT record at _smtp._tls with v=TLSRPTv1; rua=mailto: and an address you check.

How to get to p=reject without losing real email

List everything that sends email as your domain: your mailboxes, newsletter tool, CRM, invoicing software, website forms and helpdesk.
Set up SPF with one record that includes each of those services, ending in ~all.
Turn on DKIM in every one of those services, using your domain rather than theirs.
Publish DMARC with p=none and a report address, such as v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.
Read the reports for two to four weeks. Fix any real sender that fails until everything legitimate passes.
Move to p=quarantine, then to p=reject once quarantine has run cleanly for a few weeks.

Domains you own but never send email from are quicker: publish v=spf1 -all and a DMARC record with p=reject straight away, so they can't be used for fakes either.

What the checker can't see

Whether your emails pass. It checks the records exist and are valid, not whether each service signs with your domain. DMARC reports show that.
Custom DKIM selectors. It tries 24 common names. If yours isn't one of them, it'll show as not found even when it's working.
Your mailbox security. Passwords and two-step verification on your email accounts matter just as much.

How to read your result

The headline answer comes from your DMARC policy, because that's what decides whether receivers stop fakes. Your score adds up all eight checks: a pass earns full points, “Improve” earns half and “Fix” earns none. Checks that don't apply, such as MTA-STS on a domain that doesn't receive email, are left out.

No DMARC, or p=none
Yes, someone could spoof you
Anyone can send email with your domain in the From address, and receiving servers aren't told to stop it. Some will still land in spam, but you're relying on each provider's filters rather than your own policy.
p=quarantine, or partial reject
Partly protected
Email that fails authentication should go to spam rather than the inbox. Moving to p=reject tells receivers to refuse fakes completely.
p=reject
Unlikely
Your DMARC policy tells receiving servers to refuse email that fails authentication, so fakes using your domain shouldn't reach anyone. Keep the reports switched on so you notice if a real sender starts failing.

Frequently asked questions

What is email spoofing?

Email spoofing is sending an email with someone else's address in the From line. Email was designed without any check on the sender, so it takes no skill. SPF, DKIM and DMARC were added later so receiving servers can check whether an email really came from the domain it claims.

What's the difference between SPF, DKIM and DMARC?

SPF lists the servers allowed to send your email. DKIM adds a digital signature to each email. DMARC ties them together: it tells receivers to check that the domain people see in the From line matches what SPF or DKIM verified, and what to do when it doesn't.

Is p=none enough?

It's enough to meet Google's rules for bulk senders, which accept a DMARC policy of none, but it doesn't stop spoofing. With p=none, receivers are told to deliver failing email as normal. Treat it as the starting point that switches on reports, then move to quarantine and reject.

Will p=reject stop my own emails?

Only if a service that sends email for you isn't set up with SPF or DKIM. That's why you start with p=none and read the reports: they list every server sending as your domain, so you can fix the real ones before you start rejecting.

Why does the checker say DKIM wasn't found?

DKIM keys sit under a selector name chosen by your email provider, and there's no way to list them all from outside. The checker tries 24 common ones. If your provider uses its own, your DKIM may be fine: check your provider's admin settings, or look for a DKIM-Signature line in the headers of an email you sent.

Does this protect me from phishing emails I receive?

Not directly. SPF, DKIM and DMARC on your domain stop other people sending fakes as you, which protects your customers and suppliers. Your own inbox relies on your email provider's filtering, and on the senders you hear from having set up their records.

What does too many SPF lookups mean?

Each include in your SPF record can trigger more DNS lookups, and includes inside includes add up. The SPF standard caps the total at 10. Go over it and SPF fails for every email you send, even from servers you listed.

What happens to the domain I enter?

Your browser looks up its public DNS records through Google Public DNS, or Cloudflare's if Google doesn't respond. Nothing is sent to us unless you request a review, and no email is sent to or from the domain.

Keep going

Free · 8 checks

Domain Hijack Checker

Could someone hijack your domain? Check its registrar locks, renewal date, DNSSEC, CAA record and forgotten subdomains, with a score out of 100 and a fix for every gap.

Free · 40+ key types

API Key Leak Checker

Is your website leaking API keys? Scan your HTML and JavaScript for secret keys, tokens and passwords any visitor could copy, and see which keys are meant to be public.

Free · 3 minutes

AI Search Readiness Scorecard

Is your website AI-friendly? Fifteen questions show how likely ChatGPT, Perplexity, Gemini and Google AI Overviews are to recommend your brand, with a prioritised fix list.