Can someone send email pretending to be you?

If your domain has no SPF and no DMARC record, anyone in the world can send an email that appears to come from your address, and most inboxes will deliver it. This checks both in a couple of seconds.

Check my email records

Enter your website address. We run the check against your live site and show you this section of the results in a few seconds.

Website address Check if I can be spoofed

Checks run against your live site. We record the website address you check, the pass, warn and fail counts, and your email address. We use your email to run the check, and to send marketing only if you tick the box. We do not sell, rent or share your details. Ten free scans per hour.

What this checks

• SPF recordWithout SPF, anyone can send email that looks like it came from your domain.
• DMARC recordDMARC tells inboxes what to do with spoofed mail. Missing = your domain is spoofable.

Why it matters

This is the check that makes people go quiet. Email was built without any way of proving who sent a message. SPF and DMARC are the two DNS records that close that hole, and a domain without them can be impersonated by anybody who can type.

The attack that follows is not exotic. Somebody sends your customer an invoice that appears to come from your billing address, with your branding, changing only the bank details. Your customer pays it. They are out the money, you are out a customer, and the email passed every check their mail server performed, because there were none to perform.

It cuts the other way too. Without these records your genuine mail is more likely to be filtered as spam, because inboxes increasingly treat unauthenticated mail as suspicious. Google and Yahoo both began enforcing authentication requirements on bulk senders in 2024.

How to fix it

1. Publish an SPF record

   A single TXT record in your DNS listing which servers are allowed to send mail for your domain. Your email provider publishes the exact value to use. It takes one entry and a few minutes to propagate.

2. Publish a DMARC record

   Another TXT record, at _dmarc.yourdomain.com, telling inboxes what to do with mail that fails the check. Start at p=none, which changes nothing but sends you reports on who is sending as you.

3. Read the reports, then tighten

   The reports show every source sending mail as your domain, including the ones you forgot, like your invoicing software and your booking system. Once the legitimate senders are all covered, move to p=quarantine and then p=reject, which is the setting that actually stops the fake invoice.

4. Add DKIM while you are in there

   DKIM cryptographically signs your outgoing mail. It is the third leg of the stool and most providers will turn it on for you. This tool checks SPF and DMARC, which are the two that are readable from outside without knowing your provider.

Questions

I use Microsoft 365 or Google Workspace. Am I covered?

Not automatically. Those services make it easy to publish the records, but somebody still has to add them to your DNS, and plenty of domains never get past the setup wizard. That is precisely what this check reads.

Does this stop all email fraud?

No. It stops somebody sending from your exact domain, which is the most convincing version. It does not stop a lookalike domain, where an attacker registers something one character different. For that, watch for near-miss registrations of your name.

Is p=none good enough?

It is a good first step and it is safe, but on its own it only gives you visibility. Mail that fails still gets delivered. The protection arrives when you move to quarantine or reject, once the reports show your legitimate senders are all passing.

The other seven checks

Each one is free, instant and needs just your email address. Or run all 25 at once.

This is an automated check of what is publicly visible on your website. It is a plain language summary, not legal advice, and passing it does not by itself make you compliant with any particular law. Where a rule is mentioned, confirm it against the source before acting on it.