Email security check

SPF, DKIM and DMARC Check: Can Someone Send Email as You?

Fake invoices and payment-change requests start with email that looks like it came from you or your vendor. Enter your domain to grade your DMARC, SPF and DKIM, find lookalike domains registered by someone else, and see how your Microsoft 365 sign-in is set up.

See who can send email as youWhat we check
Email securitySAMPLE
C
yourcompany.com
Can be spoofed
Spoofing policy (DMARC)p=none
Approved senders (SPF)Weak
Lookalike domains4 found
Signing (DKIM)Found
Public DNS & registry records

We use this to send your results and the tracker. No newsletter sign-up. Privacy policy

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
What we check

What your domain tells an attacker

$3.05B
lost to business email compromise in 2025, per the FBI
p=none
a monitor-only DMARC policy, which still lets spoofed mail through
1 letter
between your domain and the lookalike an attacker registers
10 lookups
the most an SPF record may use before receivers treat it as broken

DMARC tells receiving mail servers what to do with email that fakes your domain. At p=reject, servers that follow it refuse the fake. At p=none, they deliver it and send you a report. SPF lists the servers allowed to send as you, and DKIM signs your mail so receivers can prove it is genuine.

DMARC cannot stop a domain that only looks like yours. We try more than a hundred common lookalikes, such as a missing letter, swapped letters, rn for m or a different ending, and flag the ones that are registered and set up to send and receive email.

Everything comes from public DNS, domain registry and Microsoft sign-in records, the same outside view attackers and cyber insurers have. We do not send email, sign in or touch your systems. We keep the domain checked and the time, and nothing else unless you ask for the report.

What it cannot see: whether MFA is enforced for everyone, mailbox forwarding and hidden inbox rules, risky app consents, and who holds admin rights. That takes a read-only look inside your Microsoft 365 tenant.

What to do with your result

A Microsoft 365 and Azure security assessment looks inside your tenant at what this check cannot see. CLOUDSKOPE SARTUS™ finds and fixes those gaps in six days, for a fixed fee. To see how invoice fraud usually starts, read our business email compromise analysis.

What SPF, DKIM and DMARC each do

Three DNS records decide whether a mail server believes a message came from your domain. SPF lists the servers that may send for you, DKIM signs each message, and DMARC ties both to the From address people read and tells receivers what to do when a message fails. MTA-STS protects mail on its way to you. None of them stops a domain that only looks like yours.

Control
What it stops
What failure looks like
How to fix it
SPF
What it stops
Mail sent from servers you never approved.
What failure looks like
No record, two records, an ending of +all or ?all, or more than 10 DNS lookups, which receivers treat as a permanent error.
How to fix it
Publish one record listing every service that sends as you, ending in ~all or -all. Remove services you no longer use.
DKIM
What it stops
Messages changed in transit, and forged mail that claims your signature.
What failure looks like
Signing is off, or a vendor signs with its own domain instead of yours, so the signature does not count for DMARC.
How to fix it
Turn on DKIM for your domain in Microsoft 365 or Google Workspace and every service that sends as you, with 2048-bit keys.
DMARC
What it stops
Email that puts your exact domain in the From line without passing SPF or DKIM for that domain.
What failure looks like
No record, or p=none, which tells receivers to deliver the fake and send you a report.
How to fix it
Publish a record with a rua= reporting address, fix the senders the reports show failing, then move to p=quarantine and p=reject.
MTA-STS
What it stops
An attacker on the network forcing mail to your domain to travel unencrypted, or to a server that is not yours.
What failure looks like
No policy, so sending servers quietly fall back to plain text when encryption fails.
How to fix it
Publish the _mta-sts record and a policy file, turn on TLS reporting (TLS-RPT), start in testing mode, then switch to enforce.
Lookalike domains
What it stops
Nothing in your DNS. Your records protect only your exact domain.
What failure looks like
A domain one letter off from yours or a vendor's, set up to send email, used for fake invoices and payment-change requests.
How to fix it
Register the closest variants yourself, watch for new ones, and require a call-back on a known number before any change to payment details.

Reading your grade

The grade is out of 100: DMARC 35 points, SPF 20, lookalike domains 20, DKIM 15, MTA-STS 6 and TLS reporting 4. An A takes 90, a B 80, a C 65 and a D 50. A domain at p=none cannot score above a C, because a monitor-only policy earns 8 of the 35 DMARC points.

Google and Yahoo (since February 2024) and Microsoft for Outlook.com (since 2025) require anyone sending more than 5,000 messages a day to their users to publish SPF, DKIM and DMARC, with SPF or DKIM aligned to the From domain. p=none meets that minimum. It does not stop spoofed mail.

The most common DMARC mistakes

p=none forever. Set up to watch, never moved. It stops nothing.

No rua= address. Without aggregate reports you cannot see who sends as you, so you cannot safely move to reject.

SPF over 10 lookups. Each new platform's include adds lookups. Past 10, receivers can return an error even for your real servers, and once DMARC is enforced, mail without your own DKIM signature can be junked or refused.

Third-party senders not aligned. Payroll, CRM, invoicing and marketing platforms often send as you but sign with their own domain. SPF and DKIM pass for them, not for you, so DMARC fails. Set up DKIM for your domain in each platform before you enforce.

New to these terms? Read what SPF, DKIM and DMARC are.

FAQ

Email security questions, answered

p=reject, covering all mail, with a rua address so you receive reports. Most organizations get there in stages: p=none to see who sends as them, then p=quarantine, then p=reject.

Safe from exact spoofing, not from lookalikes or real account takeovers. Attackers register a domain one letter off, or take over a real mailbox at your company or a vendor and send from it. A call-back on a known number before any change to payment details is the control that works.

DKIM keys sit under a name, called a selector, that only your email provider knows. We check the common ones. If yours uses a custom name, ask whoever runs your email to confirm signing is on.

No. Some are your own defensive registrations and some are parked by domain investors. The ones that can receive email and were registered recently deserve a closer look. We leave out domains that share your name servers or were registered alongside yours.

We keep the domain you checked and the time, so we can see how the tool is used. If you ask for the report, we also receive your contact details and the results.

No. It reads public DNS, registry and Microsoft sign-in records only. Nothing is sent to the domain you check.

Ground truth. Not story.

If someone can send email as you, the question is whether they already have.

Since May 1, 2026, our forensic audits have prevented $2.2M in wire fraud, none of it flagged first by the client's IT team, managed service provider, bank or security tools.

Find out who is sending as you