How to check if your domain can be spoofed (free DMARC checker)

Zybim guides · Email security

Here's an uncomfortable fact: for a large share of business domains, anyone on the internet can send an email that appears to come from your company — your CEO, your finance team, your billing address — and it will land in the recipient's inbox looking completely genuine. This is called email spoofing, and it's the mechanism behind most Business Email Compromise (BEC) and CEO-fraud attacks, which cost organisations billions every year.

The good news: whether your domain is protected comes down to three DNS records — DMARC, SPF and DKIM — and you can check them in seconds. This guide explains what each one does, how to read your results, and how to fix the gaps.

Why spoofing works (and why it's so common)

Email was designed in an era of trust. By default, nothing stops a sending server from claiming to be any domain it likes — the "From" address is as easy to forge as the return address on a paper envelope. The three records below are the modern fix, layered on top of email to let receiving servers verify that a message really came from you. If they're missing or misconfigured, receiving servers have no way to tell your real mail from a forgery, so they deliver both.

The three records that protect you

SPF — who is allowed to send

SPF (Sender Policy Framework) is a public list of the mail servers permitted to send email for your domain. When a receiving server gets a message claiming to be from you, it checks whether the sending server is on your SPF list. The strongest SPF records end in -all, which tells receivers to reject anything not on the list. A weaker ~all (soft-fail) only marks it suspicious. If you have no SPF record at all, there's no list to check against.

DKIM — a tamper-proof signature

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to your outgoing mail. The receiving server uses a public key published in your DNS to verify that the message genuinely came from your domain and wasn't altered in transit. Without DKIM, recipients can't cryptographically confirm your mail is authentic.

DMARC — the policy that ties it together

DMARC (Domain-based Message Authentication, Reporting and Conformance) is the most important of the three. It tells receiving servers what to do when a message fails SPF and DKIM checks, and it lets you receive reports on who's sending mail as your domain. A DMARC record has a policy:

• p=none — monitor only. You get reports, but spoofed mail is still delivered. This is a starting point, not protection.
• p=quarantine — send failing mail to spam/junk. Good.
• p=reject — refuse failing mail outright. This is full protection, and the goal.

A domain with no DMARC record, or one stuck at p=none, is effectively unprotected against spoofing even if SPF and DKIM exist — because nothing enforces them.

How to check your domain

You could look up each record manually with DNS tools, but the fastest way is an automated checker that reads all three at once and grades the result. Our free email security check does exactly that: enter a domain and it reads the public DNS records for DMARC, SPF, DKIM (and MTA-STS), then tells you your grade and the specific gaps — no login, no consent, nothing installed. It works on any domain, so you can check your own, a supplier's, or a client's.

What to do with the results

If your check comes back clean (a strong DMARC policy plus valid SPF and DKIM), you're in good shape — keep monitoring it, because records drift as you add and remove mail services. If it shows gaps, the fix order is usually: publish or tighten SPF, enable DKIM signing with your mail provider, then introduce DMARC at p=none to gather data, and progressively move to p=quarantine and finally p=reject once you're confident legitimate mail passes. Rushing straight to p=reject without checking your reports can block your own mail, so the staged approach matters.

Email is one door — check the rest of the house

Email authentication is one important part of your security posture, but it's not the whole picture. The same attackers who spoof your domain also look for weak identity settings, missing multi-factor authentication, over-permissive access, and misconfigured cloud resources. If your business runs on Microsoft 365, your tenant already keeps a Secure Score measuring all of this — most organisations just never look at it.

Zybim Technologies is a verified Microsoft partner. Our assessments are read-only, use a publisher-verified Microsoft application, and can be revoked at any time.