Free tool
Can someone send email as your domain?
We read your domain's public DNS and check every record that decides whether your mail is trusted and whether spoofed mail gets through.
What we check
The records receivers look at
- SPF: which servers may send for you, and whether you are over the 10 DNS lookup limit
- DMARC: what receivers do with mail that fails, and where reports go
- DKIM: signing keys at the common selector names
- MTA-STS and TLS reports: whether mail to you must be encrypted
- CAA and DNSSEC: who may issue certificates, and whether DNS answers are signed
Read only
Public DNS, nothing else
We only read records anyone can look up, plus your public MTA-STS policy file. No email is sent and nothing is stored beyond a ten-minute cache.
Want it fixed?
Stop spoofing without losing real mail
Moving DMARC from none to reject is safe once every real sender passes. An architecture session maps your senders and the order to switch them over.