// free tool
Can someone send email pretending to be you?
For most small businesses the answer is yes, and nobody has ever told them. This checks the three DNS records that decide it — SPF, DKIM and DMARC — and tells you plainly what is missing.
No signup, no email address, no waiting. It reads public DNS records — nothing is sent to your mail server and nothing is changed.
What these three records actually do
SPF lists which servers are allowed to send email as your domain. Without it, anyone can.
DKIM signs your outgoing mail so receivers can prove it was not altered or forged in transit.
DMARC is the one that matters most and the one most often missing. It tells receiving servers what to do when a message fails the checks above — and sends you reports of who is trying to impersonate you. SPF without DMARC accomplishes very little.
The common failure is not "no security at all." It is a DMARC record set to
p=none — monitor-only. It looks configured, it reports problems, and it blocks
nothing. Spoofed invoices still land in your customers' inboxes.
Why this is worth ten seconds
Invoice fraud and "the boss needs gift cards" emails work because the message genuinely appears to come from a real company's domain. The fix is a DNS change, not a product you have to buy — but it has to be done in the right order, or you will start blocking your own legitimate mail.
Checks are logged so I can see which problems are most common. Domains only — no personal information is collected, and nothing is shared or sold.