free tool

Email spoofing checker

Enter a domain and we read its mail records from public DNS: whether someone could send email that looks like it comes from you, and what to change if so.

No account and no card. For every check at once, run the free website health check.

Checked once, right now Shown once, never stored

01 / what it reads

Three records, one question

We look the domain up in public DNS, the way a receiving mail server does. Nothing is sent to your server or your mailbox. A site at shop.example.com is checked as example.com, the domain a forged From line would use.

01

DMARC

Whether receivers are told to refuse or quarantine mail that fails the check. This is what decides whether a forgery is delivered: none, or no record at all, means it is.

02

SPF

Whether the domain lists its sending servers and ends the list with ~all or -all, has only one record, and stays under the 10-lookup limit counted through its includes.

03

MTA-STS

For a domain that receives mail, whether it asks senders to deliver to it encrypted. Advice only: it protects mail to you, not against forgery from you.

02 / fixing it

The usual order

Tightening DMARC before your own mail passes would send your own mail to spam. So the order matters.

  1. 01Publish one SPF record listing every service that sends as you (your mailbox provider, newsletter tool, web shop), ending in ~all.
  2. 02Turn on DKIM signing at each of those services; they give you the DNS record to add.
  3. 03Publish DMARC with p=none and a rua= address for reports, and read them for a week or two.
  4. 04When everything legitimate passes, move to p=quarantine, then p=reject.
  5. 05A domain that sends no mail at all: publish v=spf1 -all and v=DMARC1; p=reject straight away.

03 / limits

What it does not check

  • DKIM. Its key is published under a selector only your mail provider knows, so it cannot be looked up from outside.
  • Whether a real message passes: no test mail is sent. A receiver's own headers ("Show original" in Gmail) show that.
  • DMARC reports. They are sent to the rua= address in your record, for a reporting service to read.
  • Anything on a later date: the result is true of the moment you pressed the button.

questions

Questions

Can someone send email pretending to be my domain?

Yes, unless the domain tells receiving mail servers to refuse forgeries. Anyone can type any address into the From line of an email; what stops it arriving is a DMARC record set to p=quarantine or p=reject, which tells Gmail, Outlook and others to turn away mail that cannot prove it came from you.

Without one, or with p=none, forged mail is delivered and only the spam filter stands in the way.

What is the difference between SPF, DKIM and DMARC?

SPF lists the servers allowed to send mail for the domain. DKIM signs each message so a receiver can check it was not altered and came from the domain. DMARC ties the two to the address in the From line and says what to do with mail that fails: nothing, spam folder, or refuse.

This checker reads SPF and DMARC. It cannot read DKIM: a DKIM key is published under a name (the selector) that only your mail provider knows, so it cannot be looked up from outside.

What does DMARC p=none mean?

It means "report, but do nothing". Receivers send you reports about mail that failed the check and still deliver it. It is the right first step, to find every service that legitimately sends as you, and the wrong place to stay: a forgery is delivered exactly as before.

Once your own mail passes, move to p=quarantine, then p=reject.

Why does SPF have a limit of 10 DNS lookups?

The SPF standard (RFC 7208) lets a receiver stop after 10 DNS-querying terms — include, a, mx, ptr, exists and redirect, counted through every include. Past that the whole record fails, so every mail service you add with an include brings you closer to an SPF record that stops working. This checker counts them for you.

Can these records be checked automatically?

Yes, on every plan, by monitoring the site. The records are read daily, shown on the site's page and counted in its security grade. Monitoring does not send an alert when a record changes.

Other free checks

  • SSL certificate checker

    Checks a site's TLS certificate once, now: whether a browser trusts it, who issued it and how many days it has left.

  • Domain expiry checker

    Looks a domain up with its registry over RDAP or WHOIS and reports the registrar and the date the registration runs out.

  • Broken link checker

    Follows the links on one page and lists the ones that no longer answer, separately from those whose server turned the check away.

  • Meta tag checker

    Reads one page's title, meta description, social image and mobile viewport, and says which are missing.

  • Security headers checker

    Reads one page's security headers, the cookies it sets and its security.txt, and says what to fix and what is only advice.

  • Website health check

    Every check at once: uptime, the certificate, the domain, links and meta tags.

Keep it fixed

Monitoring re-reads the records daily, and counts them in each site's A–F security grade. Free covers 3 sites, takes no card and keeps running for as long as somebody signs in.

Get started See pricing