Free check
Check your email security
Two settings of your domain, SPF and DMARC, decide whether mail servers stop a forged email with your address. Enter your domain below; the check reads only public DNS data and keeps nothing.
Free check
Can someone send email in your company's name?
Two settings of your domain, SPF and DMARC, decide whether mail servers stop a forged email with your address. Enter your domain and see where you stand straight away.
We only read public DNS data and do not keep your domain name or the result.
How email spoofing works
How someone can send email in your company's name
Anyone can type your address in the From line of an email. Three DNS settings of your domain, SPF, DKIM and DMARC, help receiving mail servers tell a real email from a forged one. Click through the steps to see what happens to a forged email, and what your own setting changes.
Attacker's server. From: invoice@yourcompany.be. Hidden sender: bounce@mailer.example.net.
Step 1 of 5. A forged email is written
Someone sets up a mail server and writes an email that looks like it comes from you: invoice@yourcompany.be, asking a customer to pay into a new bank account. An email has two sender addresses: the one people see in their mail app, and a hidden one servers use between themselves. The attacker puts your address in the first and their own in the second.
Based on the SPF, DKIM and DMARC internet standards and the published rules of Gmail and Microsoft 365. Receivers may apply their own filters on top.
What the result means
'In order' means mail servers already reject or flag forged email using your domain. 'Missing' or 'partly' means anyone can currently send email that looks like it came from you — usually fixed by adding or correcting one DNS record.
Doing it yourself? A four-week plan, step by step
We can look at it with you