Can someone spoof your domain?
A free email spoofing test. In about ten seconds, see whether a stranger can send email as your domain today, which SPF and DKIM holes let fake mail pass DMARC, and which look-alike domains can send mail.
Three ways email pretends to be you
The test checks each one separately, because each has a different fix. A domain can be fully protected on one and wide open on another.
- Your exact domain: Mail with your real domain in the From address. Your DMARC policy decides whether receivers deliver it, send it to spam or refuse it.
- Mail that passes DMARC anyway: Holes in SPF and DKIM, such as +all or a weak key, that let fake mail pass even with an enforcing policy.
- Look-alike domains: Names one typo or one word away from yours. DMARC cannot stop them, so the only defence is to know they exist.
How the grade works
A domain anyone can spoof outright (no DMARC record, two records, or p=none) is graded F, whatever else is right. Partial protection (quarantine, pct below 100, weaker subdomain policies) and record problems in SPF and DKIM lower the score from there, and so do look-alikes that can send mail. The fix list puts the most urgent change first and gives the exact record to publish where we can.
After the test
DNS shows what you publish, not who sends as you. To find your own senders before you enforce, and to be told when a look-alike domain starts sending, use DMARC monitoring. For a full record-by-record health check, run the domain scanner, or create a record with the DMARC generator.
Email spoofing test questions
Can someone spoof my email domain?
Yes, unless your domain publishes a DMARC record with p=quarantine or p=reject. Email lets any server put any address in the From line. DMARC is how you tell receiving mail servers to block mail that claims to be from you but fails SPF and DKIM. With no DMARC record, or with p=none, that mail is still delivered.
How does this email spoofing test work?
It reads your domain's public DNS: the DMARC record, the SPF record, DKIM keys at the common selector names and the MX records. It also checks a sample of the likeliest look-alike domains to see whether they are registered and set up to send mail. It sends no email and changes nothing.
What can't the test detect?
Display-name spoofing, where an attacker sends from their own address but shows your name; nothing in DNS can detect or block it. It also cannot see who actually sends email as your domain or whether your own mail passes: only DMARC aggregate reports show that. Subdomains that point at deleted cloud services are checked by monitoring, not by this quick scan.
What does 'passes DMARC anyway' mean?
Even with p=reject, some records let fake mail pass. An SPF record ending in +all authorises every server on the internet, and a DKIM key that is too short can be broken and used to sign mail as you. Record errors such as two SPF records or more than 10 DNS lookups make SPF fail for your own mail, which pushes people back to weaker policies.
Why do look-alike domains matter if my DMARC is set to reject?
DMARC protects your exact domain name. Someone who registers a name like yourcompany-billing.com or yourcornpany.com owns that domain, so their mail passes DMARC for it, and your record cannot stop it. The test flags look-alikes that can already send mail. Some may be registered by you.
Will fixing these issues break my email?
It can if you move to p=reject before you know who sends as you. Start with p=none and a reporting address, read the DMARC reports to find and fix your own senders, then move to p=quarantine and p=reject. An unused domain that sends no mail can be locked down straight away, because there is nothing to break.
As a global team, we’re always available. Let’s talk!
© 2026 yourDMARC
Download to read the eBook
