An email that looks like it comes from your company, from your domain, asking someone to pay an invoice into a different account. If your domain is not properly protected, anyone can send it. Check it here in seconds.
Free · No sign-up · 10 seconds
Can someone send emails pretending to be your company?
Type your domain or email address. We check SPF, DKIM, DMARC and five more protections, and explain the result in plain language.
Checking
- Mail servers (MX)
- Authorised senders (SPF)
- Email signatures (DKIM)
- Fake email policy (DMARC)
- Mandatory encryption (MTA-STS)
- Encryption reports (TLS-RPT)
- Signed zone (DNSSEC)
- Logo in the inbox (BIMI)
Shall we make it perfect?
We will walk you through the report and tell you what to change, with no obligation. If you give us an address on your own domain, we will also email you the full report.
What we check
SPF is the list of servers allowed to send email on behalf of your domain. Without it, anyone can.
DKIM signs every email, so the receiver can check it really comes from your domain and was not changed on the way.
DMARC tells Gmail, Outlook and the rest what to do with an email that claims to be yours and fails those tests: deliver it, send it to spam or reject it. It is what really stops impersonation.
Plus four extras that set great email apart from good email: mandatory encryption (MTA-STS), encryption reports (TLS-RPT), a signed zone (DNSSEC) and your logo next to your emails (BIMI).
Why it matters
Many invoice frauds start with an email that looks like it comes from a trusted supplier. We explain it in this note. With SPF, DKIM and DMARC set up properly, that email never reaches the inbox.
Frequently asked questions
Is it free? Do I need to sign up?
It is free and there is no sign-up. We only ask for your details if you want our help fixing it.
What exactly do you look at?
Only the public DNS records of your domain, the same ones every mail server in the world checks before delivering a message to you. We do not access your mailbox or send anything.
I got a low grade. Is it serious?
If the result says your email can be impersonated, yes: it is worth fixing soon. It is almost always a matter of configuring your DNS and email admin panel properly, without changing provider.
It says DKIM was not found, but I think I have it
DKIM is published under a name (selector) chosen by each provider, and it cannot be listed. We try the most common ones; if yours is different, it may be fine. We can confirm it from the headers of one of your emails.