Free tool · no sign-up
Free Email Spoofing Check: can someone fake email from your domain?
Test your domain’s SPF, DKIM and DMARC records in a few seconds. You get a simple A to F grade and plain-English steps to fix anything that lets criminals send email in your name.
Why email spoofing matters to your business
Email was never designed to check who a message is really from. Three public DNS records fix that: SPF, DKIM and DMARC. If they’re missing or too relaxed, anyone can send email that shows your exact address in the From line.
Fake invoices
An email that looks like it’s from your accounts team asks a client to pay a new bank account. The money is usually gone within hours.
Payment change requests
Criminals pose as your company and ask suppliers or staff to update banking details. It’s one of the most common business email scams.
Phishing your own staff
A message from your own domain gets opened and trusted. One click on a fake login page can hand over a Microsoft 365 password.
What the email spoofing check looks at
DMARC
Tells other mail servers what to do with email that fails the checks: let it through, send it to spam, or reject it. A reject policy is the goal.
SPF
The list of servers allowed to send email for your domain, such as Microsoft 365 or your billing system. It should end with a strict rule.
DKIM
A digital signature added to your real outgoing email, so receivers can prove it came from you and wasn’t changed.
Mail servers (MX)
Shows who handles your email, for example Microsoft 365 or Google Workspace, so the fix steps match your setup.
Your grade is out of 100: DMARC counts most, then SPF, DKIM and your mail servers. A or B means you’re well protected. C or below means someone could likely send convincing fake email from your domain today.
Email spoofing check: common questions
What is email spoofing?
Email spoofing is when someone sends an email that shows your address in the From line without having access to your mailbox. It’s used for fake invoices, payment fraud and phishing. SPF, DKIM and DMARC are the records that stop it.
Is this email security check safe and private?
Yes. It only reads public DNS records that anyone on the internet can see. It doesn’t touch your mailbox or need a password, and we don’t keep a list of the domains people check.
What is a DMARC record and do I need one?
DMARC tells other mail servers what to do when an email claims to be from you but fails SPF and DKIM. Without it, most fake email still gets delivered. Every business that sends email should have one, ideally set to reject.
Do I need SPF, DKIM and DMARC, or just one?
All three work together. SPF lists who may send for you, DKIM signs your real email, and DMARC enforces the rules and sends you reports. Microsoft and Google now expect all three from bulk senders.
Why does it say you couldn’t find my DKIM key?
DKIM keys sit under a name chosen by your email platform. We check the common ones used by Microsoft 365, Google Workspace and popular mailing services. If yours uses a custom name, it may be set up correctly even though we can’t see it.
My domain got a low grade. How do I fix it?
The fixes are changes to your DNS records, made wherever your domain is managed. They need care, because a wrong SPF or DMARC setting can block your real email. A SinghIT engineer can review which services send email for you and make the changes safely, usually in one session.
Should I check domains we don’t use for email?
Yes. Criminals like parked or old domains because nobody watches them. A domain that never sends email should have an SPF record of “v=spf1 -all” and a DMARC policy of reject.
Related help
Want your email locked down?
Book a free security check. A certified SinghIT engineer reviews your email setup and shows you exactly what to fix.
437-880-2051
contact@singhit.com
solutions@singhit.com