What email spoofing is, and why it matters
Email spoofing is when a criminal sends an email that appears to come from your business, using your exact domain in the From address. It is how invoice fraud, fake supplier requests and staff impersonation usually begin. The recipient sees your name, trusts it, and acts on it.
The frustrating part is that stopping it is not about your own inbox. It depends on records published in your domain DNS that tell every other mail server in the world whether to trust email claiming to be from you. Get them right and spoofed email is rejected before it lands. Leave them weak and anyone can impersonate you.
What this tool checks
It runs the same checks a receiving mail server does, live, against your domain:
- SPF lists which servers are allowed to send email for your domain. Without it, or with a weak setting, unknown senders are not challenged.
- DMARC is the control that actually stops spoofing. It tells other mail servers what to do with email that fails the checks: nothing, send to junk, or reject. Only a policy of reject fully blocks impersonation.
- DKIM adds a cryptographic signature to your email. We check for it where we can, though it can use a custom name, so we treat it as informational.
The result is a plain verdict on whether your business email can be spoofed today, and what to change if it can. If you would like it set up properly, that is exactly the kind of thing we do for clients, alongside broader cyber security work.
What about DKIM?
DKIM adds a hidden signature that proves an email really came from you and was not altered on the way. We check for it, but it can be published under a custom name we cannot always see, so we treat it as a useful extra rather than the deciding factor. DMARC is what actually settles that.
Already have an IT provider?
If you do, and your result is anything less than protected, it is worth asking them why. Configuring SPF and DMARC is not advanced or expensive work. It is a basic, well established control that any competent provider should have set up and kept enforced from day one. An exposed domain is rarely a sign that email security is hard. It is usually a sign that something foundational was overlooked, and that is a fair question to put to whoever looks after your IT. It is exactly the kind of thing we make sure is right for the businesses we work with.
