Free tool: email spoofing check
Can someone send email pretending to be your business?
Type your website. In a few seconds you will see whether your email can be faked, and what to change if it can. It only reads public records; nothing touches your mail.
What it checks
Read the same way a mail server or a browser reads it
- SPF
- The list of servers allowed to send mail for your domain, and whether it tells the world to reject everyone else or merely shrug.
- DMARC
- The record that tells Gmail, Outlook and everyone else what to do with mail that fails the checks: deliver it, quarantine it, or refuse it.
- DKIM
- Whether your mail is signed, so a receiving server can tell a real message from you from a forged one.
- Who handles your mail
- Which provider your mail runs through, so the fix can be written for the system you actually use.
Why it matters
What this has to do with a small business
Invoice fraud is the most expensive crime small businesses report, and most of it starts with an email that looks like it came from someone the victim trusts. A customer gets a message from your address saying your bank details have changed. They pay. The money is gone.
Three short records in your domain settings decide whether that email lands in their inbox or gets refused. Most small businesses have one of them, set loosely, because nobody told them the other two existed.
Questions
What people ask about this
What is email spoofing?
Sending an email with a forged From address so it appears to come from someone else. It needs no access to your account; the sender simply claims to be you, and without the right records, receiving servers have no way to tell.
What should my DMARC policy be?
Start at p=none to collect reports, move to p=quarantine once your real mail passes, and finish at p=reject. Reject is the only setting that actually stops forged mail from being delivered.
Will fixing this break my email?
Not if it is done in order. The usual mistake is jumping straight to reject before every service that sends on your behalf, like your invoicing or newsletter tool, is in the SPF record and signing with DKIM.
Does this check read my email?
No. SPF, DMARC and DKIM are public DNS records that every mail server in the world reads before accepting a message. This reads the same records, nothing else.
More free tools
All free toolsStart with one visit
Tell us about the business and roughly how many computers. We will come back with a price and a date.