What this free check looks at
Spoofing is when someone sends mail that claims to be from your domain without controlling your real mailboxes. Lookalike domains are a related trick: an attacker registers a near-miss name (one letter off, a different TLD, or a unicode lookalike) and sends invoices that look almost right at a glance. This tool does not crawl every possible lookalike registration. It grades the public authentication records that make direct spoofing of your domain easier or harder: SPF, DKIM, and DMARC.
All three records live in public DNS. There is nothing to authorize, no mailbox content to read, and no tenant connection required. Paste a company domain, a website URL, or even an email address — the form normalizes it to the bare domain before scanning.
How to read a fail (or a weak pass)
A failing or missing SPF record means receiving servers have little guidance about which hosts are allowed to send as you. A missing or incomplete DKIM setup means messages may not carry a cryptographic signature receivers can verify. A missing or p=none DMARC policy means even when authentication fails, receivers are not told to quarantine or reject the message — so spoofed mail can still land.
Treat a red grade as a configuration gap to discuss with whoever runs your DNS and email, not as proof that fraud already happened. Treat a green grade as better hygiene for spoofing of your exact domain — not as proof that lookalike domains, compromised mailboxes, or invoice fraud are impossible.
SPF, DKIM, and DMARC on one screen
- SPF lists which servers may send mail for the domain. Overly broad includes, broken lookups, or no record at all weaken the story receivers see.
- DKIM adds a signature tied to your domain. Without working keys and selectors, receivers cannot verify that a message was authorized by your side.
- DMARC tells receivers what to do when SPF/DKIM alignment fails, and where aggregate reports can go. A published policy with a real enforcement mode is what turns authentication into a spoofing brake.
The scan report shows each check with plain-language notes so a non-expert owner can see what is missing before looping in IT or an MSP. It does not change your DNS, publish a policy for you, or guarantee inbox placement.
Limit of a one-off check vs an ongoing alarm
A free spoofing check answers one question at one moment: do the public records look healthy right now? It does not watch Microsoft 365 or Google Workspace audit logs for unexpected sign-ins, forwarding changes, inbox rules, or app grants after someone already has a password. It does not alert you when a mailbox starts forwarding invoices to an attacker, and it does not replace payment-verification habits with vendors and customers.
InboxGuards is a separate product: an account-takeover alarm that connects with read-only access to supported audit records on Google Workspace or Microsoft 365, checks them at the fastest cadence available on standard plans — no premium security licensing required — and emails plain-English alerts when configured signals match. Provider ingestion delays and API coverage still apply. Monitoring is $2 per user per month with a 30-day money-back guarantee. Hands-on remediation is not included in the subscription; an optional $199 flat-fee remediation can be separately authorized when you want help making tenant changes.
Start the $2/user alarm after you scan
Use this page whenever you want a free, no-login DNS posture snapshot. When you are ready for ongoing mailbox-takeover alarms — not a staffed SOC — connect Google Workspace or Microsoft 365 and subscribe at $2 per active user per month. See pricing, how it works, or start monitoring.