Free tool · No sign-up
Free Email Spoofing Check: Can Someone Send Email as You?
This free email spoofing check takes your business domain and, in a few seconds, shows whether criminals could send email that looks like it came from you, and what to fix if they could.
The check reads your domain’s public DNS records, the same ones every mail server reads. We do not store the domain you enter unless you ask us to email you the results.
Want the fix, step by step?
We will email you what each result means for your domain and exactly what to change, for Microsoft 365, Google Workspace or whoever runs your email.
One email with your results, then a few short follow-ups. Unsubscribe any time.What does this email spoofing check look at?
Email was designed in an era when nobody checked who a message was really from. Three DNS records were added later to fix that, and together they decide whether a fake email using your domain gets delivered, flagged or blocked. This tool checks all three, plus who handles your mail:
| Record | What it does | What good looks like |
|---|---|---|
| SPF | Lists the servers allowed to send email for your domain | One record, ending in -all or ~all |
| DKIM | Adds a digital signature to your outgoing email so receivers can tell it was not altered or forged | Signing switched on with your email provider |
| DMARC | Tells receiving servers what to do with email that fails those checks | A policy of quarantine or reject, with reports going to someone who reads them |
The one that matters most is DMARC. Without it, or with it set to p=none, receiving servers are told to deliver failing email anyway, so a criminal can send messages that appear to come from your exact address.
Why does email spoofing matter to a small business?
It is more common than most owners think: when we checked 1,101 local businesses, 63% of Polk County businesses could be impersonated by email.
Because it is how invoice fraud works. A customer gets an email that looks like it came from you, with new bank details for their next payment. Business email compromise is consistently one of the costliest crimes in the FBI’s Internet Crime Reports, and it hits small firms as hard as large ones. In logistics it is now used to hijack freight, which the FBI warned about in 2026.
There is a practical cost too. Since 2024, Google and Yahoo require SPF, DKIM and DMARC from anyone sending to their users at volume, and mail from domains without them is more likely to land in spam. Getting these records right protects your customers and your own deliverability.
What should I do if my domain fails?
Usually it is an hour or two of work, done in the right order so nothing legitimate breaks:
- Find everything that sends email as you. Your email provider, but also your website forms, invoicing or accounting software, newsletter tool, and copier scan-to-email.
- Fix SPF so it lists all of them in a single record.
- Turn on DKIM in Microsoft 365, Google Workspace or your provider’s admin center, and for any other sending service that supports it.
- Publish DMARC at
p=nonewith reporting, read the reports for a couple of weeks to catch anything you missed, then move toquarantineand finallyreject.
Skipping step 4’s monitoring period is how legitimate invoices end up in customers’ spam folders, which is why many businesses get stuck at p=none forever. That is the part we usually help with. If your email is on Microsoft 365, our guide to email security covers the wider picture.
Is this check safe to run on any domain?
Yes. It only reads public DNS records, which every mail server on the internet reads every time you send a message. Your browser asks Google’s public DNS service for them directly; nothing is sent to us unless you fill in the form. Because DKIM records live under names that vary by provider, the tool checks the common ones; if you use an unusual provider, a missing DKIM result may mean we simply did not find it.
Other free checks
See whether a password has already leaked with our password breach check, or get a full picture of your systems with a free IT assessment. iTech Plus provides cybersecurity and managed IT for businesses across Polk County, including Lakeland and Winter Haven. Call (321) 221-7117 or email info@itechplus.co.