SuperMailOS
Start free

Free tool · no signup

Can someone send email pretending to be you?

Enter a domain for a straight answer: protected, partly protected, or spoofable, based on what receivers are told to do with mail that forges it, and what to change if the answer isn't good.

01 How spoofing works

SPF alone doesn't stop it.

Email lets any server write any From address. What stops a forgery reaching an inbox is the receiver checking it, and being told what to do when it fails.

Two senders on every message

There's the hidden envelope sender (the bounce address), which SPF checks, and the From address people see. A forger can pass SPF with their own domain while showing yours.

DMARC closes the gap

DMARC requires SPF or DKIM to pass for the domain in the visible From line, and tells receivers to quarantine or reject mail that doesn't.

Subdomains count too

If the policy sets sp=none, anyone can send as billing.yourdomain or any made-up subdomain, which look just as convincing in an inbox.

02 Questions

Common questions.

Something else? Write to us — a real person answers, usually the same day.

Talk to us
What does “spoofable” mean here?+
That nothing tells receivers to block mail that forges the domain in its From line: there's no DMARC record, it's invalid, or it's set to p=none. Spoofed mail may still be filtered as spam on other signals, but the domain itself offers no protection.
My SPF ends in -all. Isn't that enough?+
No. SPF checks the envelope sender, a hidden address that a forger sets to their own domain. The visible From address isn't covered by SPF at all. DMARC is what connects the check to the address people actually see.
Will p=reject stop my own mail?+
Only mail that fails both SPF and DKIM alignment, which is why you move there gradually: publish p=none with reports, fix every service the reports show failing, then tighten. Done in that order, real mail keeps flowing.
We don't send email from this domain. Does it matter?+
Yes, parked domains are popular for spoofing because nobody's watching them. Lock them down with an SPF record of v=spf1 -all, a DMARC record of p=reject, and a null MX record.

03 More free tools

Keep checking.

Each tool answers one question about a domain's email. All free, no signup.

All free tools ▶
Authentication→

DMARC checker

Every DMARC tag explained, report destinations verified, and the next step toward p=reject.

Authentication→

SPF checker

Unrolls every include and counts lookups against the 10-lookup limit, with a corrected record.

Authentication→

BIMI checker

Record, DMARC enforcement, SVG Tiny PS logo and VMC/CMC certificate, checked together.

Email your customers can trust.

Every domain you run in one inbox, from $3 a mailbox. 14 days free, no card.

Start free Talk to us