Free · Instant · Private · Checks run entirely in your browser

Can you be spoofed?

Scammers send billions of emails pretending to be businesses they're not. Type your domain and find out, in about ten seconds, whether yours is one they could impersonate.

Try it on any domain: , , or your own.

What is email spoofing?

The email system was designed in the 1980s, when the internet was a friendly place. Out of the box, anyone can put any address in the "From" line, the way anyone can write any return address on an envelope. Scammers use this to send invoices, password resets and urgent requests that appear to come from real businesses.

Three free DNS records, SPF, DKIM and DMARC, let a domain owner tell the world's mail servers "here's how to recognise real mail from us; bin everything else." Most large companies publish them. Many small businesses don't, and those are exactly the ones scammers impersonate, because it works.

This checker reads those public records for any domain and translates them into plain English, with a grade and a fix list you can hand to whoever runs your email.

Curious how the giants do? We graded America's 100 biggest companies, and some very familiar names still deliver spoofed mail.

Common questions

How do I stop someone spoofing my email address?

Publish three DNS records: SPF (which servers may send your mail), DKIM (a digital signature on every message), and DMARC (what the world should do with mail that fails those checks). The one with teeth is DMARC set to p=reject. All three are free, and your email provider's help pages have copy-paste values. Run the check above to see which ones you're missing.

Why are my legitimate emails going to spam?

Very often it's the same records working in reverse: if your domain doesn't publish SPF and DKIM, or your DMARC is missing or misconfigured, big providers like Gmail and Microsoft treat your real mail with suspicion. Since 2024, Gmail and Yahoo require authentication from bulk senders. Fixing your records helps both problems at once: scammers get blocked, and your real mail gets delivered.

What is DMARC, in plain English?

DMARC is a public instruction to every mail server on earth about mail claiming to come from your domain: "if it fails authentication, deliver it anyway" (p=none), "send it to spam" (p=quarantine), or "refuse it" (p=reject). It can also send you reports about who is trying to use your name. Without DMARC, nobody is told to do anything about fakes.

Is this check safe to run on my domain?

Yes. It reads the same public DNS records that any mail server reads thousands of times a day. Nothing is sent to your domain, nothing is tested against your mail server, and nothing changes. The lookups happen in your own browser; we never even see which domain you checked.

My domain scored badly. Who should fix it?

Whoever manages your email or your DNS: that might be your IT provider, your web agency, or you via your email provider's admin panel. Use the "copy a summary" button above and send them the results. Each finding on this page includes the fix. For most small businesses it's under an hour of work in total.

I don't send email from this domain. Do I still need these records?

Yes, and this is the most-missed case. Scammers love dormant domains precisely because nobody is watching them. A non-mail domain should say so explicitly: an SPF record of v=spf1 -all, a "null MX", and DMARC p=reject. Three records, and the domain becomes useless to impersonators.