Free · No login

Email Spoofing Check

Can someone send email that looks like it came from your business?

Your domain publishes records that tell other mail servers what to do with mail that claims to be from you. Type your domain and we'll read them to you in plain English, with what to do next.

The part after the @ in your work email address, such as yourbusiness.com.

Know your DKIM selector? Add it

The name your sending service publishes its key under, such as google or selector1. You'll find it after s= in the DKIM-Signature line of a message you sent.

This reads public DNS records only. It sees nothing inside your mailbox, and we don't store the domain you check.

What the check reads

SPF
A list of the servers allowed to send mail for your domain. Receivers compare it with the server a message actually came from.
DKIM
A signature your sending service adds to each message, checked against a key you publish in DNS. Each service publishes its key under its own name, called a selector.
DMARC
Your instruction to receivers for mail that uses your domain in the From line but fails SPF and DKIM: deliver it, send it to spam, or refuse it. It also asks them to send you reports.

What the check can't see

  • It reads public DNS records only. It can't see inside your mailbox, your account settings or the messages you send.
  • It checks the exact domain you type. A lookalike domain, such as one letter changed, needs its own records and isn't covered.
  • DKIM keys sit under names that each sending service chooses. We try the common ones, and you can type yours, but we can't list every key a domain has.
  • A record can be correct while a service you use still sends mail that fails the checks. DMARC reports are how you find those.

What we keep

Nothing. We don't store the domain you check or the answer, and you don't need an account. To slow down scripts, the check allows about twenty checks from one network every ten minutes.

Go further