Employee Owned Since 2022  |  Serving Chicagoland since 1996Support: 630-523-0220Sales: 630-526-8030Remote support

Free email security tool

Is my email spoofable? Check your SPF, DKIM, and DMARC

Criminals love domains they can impersonate. Enter your domain to see whether someone could send email that looks like it came from you, and exactly what to fix.

Enter your email domain

We look up your public SPF, DKIM, and DMARC records. Nothing is stored and no email is sent.

How it works

What SPF, DKIM, and DMARC do

SPF is a public list of the servers allowed to send email for your domain. DKIM adds a digital signature to every message so receivers can tell it was not altered. DMARC ties them together and tells receiving servers what to do with email that fails: nothing, send it to spam, or reject it.

Without an enforced DMARC policy, anyone can send email that appears to come from your domain. That is how many invoice fraud and business email compromise scams start.

Next steps

How to fix a spoofable domain

Start by publishing a DMARC record with p=none and a reporting address, so you can see every service that sends email as you. Add those services to SPF and turn on DKIM for each one. Once legitimate mail passes, move to p=quarantine and then p=reject.

Go slowly. Moving to reject before every sender is configured can block real email such as invoices, newsletters, and alerts. WEBIT handles this rollout for clients as part of email security.

FAQ

Email Spoofing Checker: common questions

Does this tool send any email?

No. It only reads the public DNS records for your domain, the same records every email server on the internet can see.

Why does it say no DKIM was found?

DKIM records live under a selector name chosen by your email provider. We check the common ones, including the Microsoft 365 and Google defaults. If your provider uses a custom selector, DKIM may still be working.

Is p=none good enough?

No. p=none only monitors. It is the right first step, but it does not stop anyone from spoofing your domain. Aim for quarantine or reject.

Can WEBIT fix this for us?

Yes. We configure SPF, DKIM, and DMARC, monitor the reports, and move you to enforcement without breaking legitimate email.

More free tools

Try another tool

Security Scorecard

Ten questions, an instant A to F grade, and a fix for every gap.

Open the tool →

Cyber Insurance Readiness Checklist

The 21 controls insurers ask about, with a readiness score and gap report.

Open the tool →

IT Budget Planner for 2027

Hardware, licensing, support, security, and projects in one plan.

Open the tool →

Two new clients per month. Maximum.

Want an owner to walk through your results?

Thirty minutes, no pressure. You will leave with a clear next step, whether or not we end up working together.

Your report

Where should we send your report?

We will email your results with the records to change. A WEBIT owner may follow up to answer questions.