Free Email Spoofing Check

Free email spoofing check: can someone send email pretending to be you?

Fake invoices and payment requests work best when they appear to come from a business the recipient already trusts. This free check reads your domain’s SPF, DMARC and DKIM records, the settings that tell other mail servers which email from you is genuine, and grades them A–F in a few seconds. No sign-up to see your score, no obligation, and nothing is sent to your domain.

New Zealand: The NCSC’s Own Your Online guidance helps businesses protect themselves against online scams. Setting up SPF, DKIM and DMARC protects your customers and suppliers from scams sent in your name.

Australia: The Australian Signals Directorate’s How to combat fake emails recommends publishing SPF, signing email with DKIM, and enforcing DMARC (quarantine or reject) to block fake email.

Why your domain is worth checking

Email was never designed to prove who sent it. Unless your domain publishes the right records, anyone can send a message that shows your business name and address in the From line, and mail servers have no reason to stop it. Your customers and suppliers are the ones who receive those emails, so the damage lands on your reputation. The records that prevent it are free, live in your DNS, and are often half set up or never finished.

  • Who can send as you (SPF)

    Whether your domain lists the services allowed to send its email, what happens to email from anywhere else, and whether the record stays within the 10-lookup limit that mail servers enforce.

  • Whether fake email is blocked (DMARC)

    Whether your DMARC policy only monitors, sends fake email to spam, or blocks it outright, and whether you are collecting the reports that show who is sending as you.

  • Email signing (DKIM)

    Whether your email is digitally signed at the common record names, including Microsoft 365 and Google Workspace, and whether the signing keys are long enough.

  • Subdomains and unused domains

    Whether made-up subdomains are covered, and whether a domain that never sends email has been locked down so it can’t be used in your name.

  • A grade you can compare

    An A–F grade and score out of 100, with severities compared against widely used email security checkers, so your result means the same thing elsewhere.

  • Fixes in plain English

    Every finding comes with the record we found, why it matters and exactly what to change, rated Quick Win, Medium or Project, in a private report you can pass to whoever manages your email.