Free email spoofing test
Can scammers send email as your business?
This free email spoofing test reads the three DNS records that decide the answer: SPF, DKIM and DMARC. If they aren’t set up properly, anyone can send email that looks exactly like it came from you - fake invoices, changed bank details, the lot. Enter your domain and find out in 30 seconds.
- DMARC policy - is spoofed mail actually blocked?
- SPF - who’s allowed to send as you?
- DKIM - are your emails signed?
Free, no signup · Your domain only · Result on screen
This is what spoofing looks like to your customers.
The email on the right wasn’t sent by the business it names. It landed anyway, because the domain had no DMARC enforcement. One of your customers pays that fake invoice and it’s your name on the scam.
The fix is three DNS records done properly, then walking DMARC up to p=reject without bouncing your real mail. It’s a one-off job, and it’s what Domain Lockdown covers.
Updated bank details for payment
Accounts Payable
9:14 AMaccounts@your-business.com.au
Hi,
Quick heads up - we’ve changed banks. Please update our details for the next invoice so payment isn’t delayed:
BSB 000-000 · Acct 0000 0000
Cheers
Why email lets anyone claim to be you.
The protocol that carries email was built for a small, trusting network. It never asked senders to prove who they were. The From address you see is just a line of text the sending server types out, and nothing in the protocol checks it against the machine doing the delivering.
So a scammer needs no password and no access to your mailbox. They send from their own server and write your address in the From field. Your customer sees your business name, because that is what the message says.
SPF, DKIM and DMARC are the fixes bolted on afterwards. They live in your domain’s DNS, which is public, so any receiving mail server can look them up before deciding what to do. That’s also why this test works from outside: it reads the same records Gmail and Outlook read.
What each record proves.
Enter a domain and the scan runs the same DNS lookups a receiving mail server runs: your SPF record, your DKIM selectors and your DMARC policy. Nothing is sent. Here’s what each result tells you.
SPFWhich servers are allowed to send for you.- You publish a list of the mail servers allowed to send as your domain. A receiving server checks the sending address against that list. It proves the delivering server was authorised. It says nothing about the From address your customer reads.
DKIMThat the message really came from you, unaltered.- Your mail service signs each message with a private key. The matching public key sits in your DNS. If the signature checks out, the receiver knows the message came from a system holding your key and that nobody rewrote it in transit.
DMARCThat the two above line up, and what happens when they don't.- DMARC adds alignment: the domain that passed SPF or DKIM has to be the domain shown in the From line. It then tells the receiver what to do with mail that fails, and asks for reports so you can see who is sending as you.
The DMARC ladder, and which rung you’re on.
Your DMARC policy is the one line that decides whether spoofed mail is blocked or merely watched. There are three settings, and only one of them stops anything.
p=noneWatching, doing nothing.
Where most domains are stuck - feels safe, isn't.
p=quarantineSpoofed mail gets sent to junk.
Better - but the spoof still lands somewhere.
p=rejectSpoofed mail is blocked outright.
This is the protection.
It’s a single DNS record, walked up the ladder carefully so you don’t bounce your own legitimate mail. About 20 minutes done properly.
What to do about each failure
- No DMARC record at all
- Publish one at p=none with a reporting address. That doesn’t protect you yet, but the reports show every service sending as your domain. You need that list before you enforce anything.
- DMARC sitting at p=none
- Read a few weeks of reports, get every legitimate sender passing, then move to p=quarantine and finally p=reject. Jumping straight to reject is how businesses bounce their own invoices.
- SPF missing, broken or too broad
- A record ending in +all authorises the entire internet, which is worse than none. Past ten DNS lookups it fails outright. Trim it back to the services you genuinely send from and end it with -all.
- DKIM not signing
- Turn on signing in Microsoft 365, Google Workspace or whatever sends your mail, then publish the selector records it gives you. Do the same for anything else sending on your behalf, like your accounting software or newsletter tool.
A passing SPF record does not stop spoofing.
This is the one that catches people out. SPF is checked against the envelope sender, a hidden address used for bounces. Your customer never sees it. The address they do see is the From header, and SPF never looks at it.
So a scammer registers their own domain, publishes a perfectly valid SPF record for it, and sends a message with your business in the From line. SPF passes, on their domain. Without DMARC nothing compares the two, and the message is delivered. That’s why the scan grades DMARC first, and why p=none scores badly even when SPF and DKIM are both green.
One spoofed message, two addresses
Envelope sender · hidden
SPF passbounce@scammers-own-domain.com
SPF checks this one. It passes, on their domain.
From header · what they see
Not checked by SPFaccounts@yourbusiness.com.au
SPF never looks at it. Only DMARC compares the two.
What this test can’t see.
The scan only sees your domain from the outside. That’s the same view an attacker gets before picking a target, but it means some things it genuinely cannot tell you.
Outside the scan’s view
- Whether every service you legitimately send from is covered. Only your DMARC reports show that.
- Anything inside your Microsoft 365 or Google Workspace tenant: MFA coverage, admin roles, mailbox forwarding rules.
- Whether someone is already impersonating you on a lookalike domain, which DMARC on your own domain cannot stop.
If you want the wider outside-in picture, the full security health check adds your SSL certificate and transport encryption to the same graded report.
Your logo, next to your emails.
It’s called BIMI, and it isn’t reserved for the big end of town. Once your domain enforces DMARC, Gmail and Yahoo can show your logo beside every email you send. Your customers get proof it’s really you before they open it, and a scammer can’t fake it.
It takes two things: the lockdown work, and a mark certificate on top. The certificate is a separate annual cost from a third party. I’m walking the same path on my own domain, and I’ll tell you plainly whether it’s worth it at your size.
Some Supplier
8:47 AMInvoice attached - please find our latest...
Ewan Me IT
9:02 AMYour monthly report is ready - one thing worth a look...
Same inbox. One sender proved who they are.
Common questions
- What is email spoofing?
- Email spoofing is when a scammer sends email that appears to come from your domain - your name, your address - without ever touching your accounts. It's how fake invoices and bank-detail-change scams reach your customers, and it works when your domain's SPF, DKIM and DMARC records aren't set up properly.
- What do SPF, DKIM and DMARC actually do?
- SPF lists which servers may send email for your domain. DKIM signs your messages so a receiver can tell they weren't altered. DMARC checks that SPF or DKIM lines up with the address your customer actually sees, and tells receiving servers what to do when it doesn't. Without a DMARC policy of quarantine or reject, spoofed mail still lands.
- What is a spoof checker?
- A spoof checker reads the public DNS records that decide whether a mail server will accept a message claiming to be from your domain. That's this page: it looks up your SPF, DKIM and DMARC the same way Gmail and Outlook do, then grades what it finds in plain English.
- Is this the same as an email spoof test?
- Yes. Email spoofing test, spoof test, spoof checker, DMARC checker - all the same job. This one is records-based, so it tells you what protection is published without anyone having to send a spoofed message to prove the point.
- Can I test a domain I don't own?
- Yes. Everything it reads is public DNS, so you can run it on a supplier, a client or a competitor, the same way any mail server can. It's read-only. Nothing is changed and the domain owner isn't notified.
- Does this test send any email?
- No. It sends nothing, spoofed or otherwise - DNS lookups only. It can't get you blocklisted or trip anyone's security alerts. A copy of the result is emailed only if you ask for one.
- Is this DMARC checker really free?
- Yes - free, instant, no signup and no email gate. It runs the same DNS checks I use for paying clients and gives you a graded, plain-English result.
- My DMARC says p=none - is that bad?
- p=none means monitoring only: you're watching spoofing happen, not stopping it. Getting safely to p=reject without bouncing your own legitimate mail is exactly what my Domain Lockdown pack does.
- My SPF record passes, so why am I still spoofable?
- SPF only checks the hidden envelope address, not the From line your customer reads. A scammer can pass SPF on their own domain while showing yours in the From field. DMARC is the piece that insists the two line up, and only a policy of quarantine or reject acts when they don't.
- What can't this test see?
- It reads what any outsider can read: your public DNS. It can't see inside your Microsoft 365 or Google Workspace tenant, and it can't confirm that every service you legitimately send from is listed in your SPF record. It shows what the internet can see about your domain, which is what an attacker checks first.
- How do I get my logo showing next to my emails in Gmail?
- That's BIMI. Once your domain enforces DMARC (p=quarantine or p=reject), you can publish a BIMI record and, with a mark certificate, Gmail and Yahoo will show your logo beside every email you send. The scan above tells you whether your domain qualifies yet. The certificate is a separate annual cost, and I'll tell you honestly whether it's worth it at your size.
Rather I just did it? Domain Lockdown is the fixed-price version of everything on this page (from $295 + GST): SPF, DKIM and DMARC done properly, walked up to p=reject without bouncing your real mail, and a one-page report you keep.
Fixed-price pack
Domain Lockdown
Stop anyone sending email as your business.
1 - 2 hours · fixed scope
Secure Stripe checkout · full scope →
More free tools
- IT Health Check →How well set up is your business IT?
- Cyber Insurance Readiness Check →Would you pass your insurer's questionnaire?
- AI Search Readiness Test →Can ChatGPT find your business?
- Full Security Health Check →How exposed is your domain overall?
All tools are genuinely free. No signup, no spam. See the full list → · Found something to fix? See all fixed prices →
Spoofable, or not sure what your result means?
Book a free 15-minute chat. I'll read your result with you and tell you what to fix first.