Email Security Checker

Find out in seconds whether criminals can send email as your business.

What email spoofing is, and why it matters

Email spoofing is when a criminal sends an email that appears to come from your business, using your exact domain in the From address. It is how invoice fraud, fake supplier requests and staff impersonation usually begin. The recipient sees your name, trusts it, and acts on it.

The frustrating part is that stopping it is not about your own inbox. It depends on records published in your domain DNS that tell every other mail server in the world whether to trust email claiming to be from you. Get them right and spoofed email is rejected before it lands. Leave them weak and anyone can impersonate you.

What this tool checks

It runs the same checks a receiving mail server does, live, against your domain:

  • SPF lists which servers are allowed to send email for your domain. Without it, or with a weak setting, unknown senders are not challenged.
  • DMARC is the control that actually stops spoofing. It tells other mail servers what to do with email that fails the checks: nothing, send to junk, or reject. Only a policy of reject fully blocks impersonation.
  • DKIM adds a cryptographic signature to your email. We check for it where we can, though it can use a custom name, so we treat it as informational.

The result is a plain verdict on whether your business email can be spoofed today, and what to change if it can. If you would like it set up properly, that is exactly the kind of thing we do for clients, alongside broader cyber security work.

What about DKIM?

DKIM adds a hidden signature that proves an email really came from you and was not altered on the way. We check for it, but it can be published under a custom name we cannot always see, so we treat it as a useful extra rather than the deciding factor. DMARC is what actually settles that.

Already have an IT provider?

If your result is anything less than protected, this is something your provider should already have dealt with. SPF and DMARC are basic cyber security controls, not advanced or expensive work, and they should have been configured and kept enforced from day one. This is rarely hard to fix. More often it simply was not done, and we would be asking why. It is one of the first things we get right for the businesses we look after.

Frequently Asked Questions

Is this tool safe to use?

Yes. It only reads the public DNS records for the domain you enter, the same information any mail server can see. We do not ask for any personal details, so there is no cold call or email to expect.

My result says exposed. Is that urgent?

It is certainly worth acting on. An exposed domain means a criminal can send email that appears to come from you, which is a common route into invoice fraud and staff impersonation. The fix is usually straightforward.

We use Microsoft 365 or Google. Are we not already protected?

Not automatically. Microsoft 365 and Google Workspace give you the tools, but SPF and DMARC still have to be configured and enforced. Many businesses have them switched on in name only, with a DMARC policy that takes no action.

Can you fix this for us?

Yes. Setting up SPF, DKIM and DMARC correctly, and moving your policy to a full block without breaking legitimate email, is a standard part of what we do. Book a consultation and we will sort it.

Tired of Wondering if Your IT is Set Up Right?

Book a 30 minute discovery call. We’ll talk through your business, your current setup, and where you’d like to be. You’ll walk away with a clearer idea of what’s working, what’s vulnerable, and what to do next.

Book a 30 Minute Discovery Call