Cookies on AIGROW

We use necessary cookies to run the site. With your permission, we also use cookies for analytics, session recordings and marketing attribution.

Cookie Policy

Email spoofing checker

Enter your domain and this email spoofing checker tells you whether anyone can send email that claims to come from you. It reads your DMARC, SPF and DKIM records, explains each one in plain words and gives you the exact records to publish.

Free, no account. Ten checks per hour. We read public DNS only and send no mail.

We send the domain to our API, which reads its public DNS records. Answers are kept for five minutes.

An email spoofing checker reads the public DNS records that tell receiving mail servers what to do with mail claiming to come from your domain. Without DMARC at quarantine or reject, nothing you publish asks receivers to stop forged mail. We read DMARC, SPF, DKIM and three related records, then show the exact records to change.

How to use this checker

Enter your domain
Type the domain in your email addresses, such as example.com. A website address works too: we drop the www. The result has its own link, so you can send it to whoever manages your DNS.
Read the verdict
Forgeable means nothing you publish asks receivers to stop forged mail. Partly protected means some forged mail is only sent to spam instead of refused, or subdomains are left open. Protected means DMARC asks receivers to quarantine or refuse all mail that fails.
Publish the changes
Copy each record into your DNS host. Start DMARC at p=none with reports, check that every service sending as you passes, then move to quarantine and then reject.

Questions about this checker

Your domain has no DMARC record, or its policy is none, so nothing you publish asks receivers to quarantine or refuse mail that fails SPF and DKIM. Anyone can put your address in the From line. Some receivers still filter that mail on their own signals, but you have not asked them to.

No. DMARC covers mail that uses your exact domain in the From address. It does not stop look-alike domains, such as one with a letter changed, or a display name copied over another address. Each receiving server also decides how to apply your policy.

Yes, when a service that sends as you, such as a newsletter tool, invoicing system or help desk, fails aligned SPF and DKIM. That is why you start at p=none with aggregate reports, fix each sender the reports show, and only then raise the policy.

It reads public DNS only: MX, SPF, DMARC, DKIM at fifteen common selectors, BIMI, MTA-STS and TLS-RPT. It sends no mail, connects to no mail server and logs in nowhere. DNS cannot list selectors, so a DKIM key not found here may still exist under another name.

Yes. The page address carries the domain, as in ?domain=example.com, so anyone who opens the link runs the same check. Answers are kept for five minutes, and a DNS change can take longer to reach every resolver, so check again later after you publish.

Related tools

  • DMARC checker

    Use this DMARC checker to read policy and reporting permissions, probe DKIM keys and inspect BIMI, MTA-STS and TLS-RPT. Add your actual selector for a precise key check.

  • SPF record checker

    Use this SPF record checker to expand includes and inspect candidate IP ranges. Add your public sending IP to trace mechanism order, macros and the DNS lookup limits.

  • DKIM checker

    Use this DKIM checker to read the public key for your selector, or to try the selectors of common mail providers. See the key type, size and flags, with a fix for each problem.

Want this set up for you?

We read your records, give you the exact ones to publish, and move DMARC to enforcement in steps, reading the reports before each one.

See the DMARC setup serviceRun the free AI visibility scan