Email spoofing check: SPF & DMARC
Enter a domain to see whether someone could send email that looks like it came from you. We read the domain's SPF and DMARC records and show how to fix what's missing.
No records yet? Generate your SPF and DMARC records for free in a few clicks.
What is SPF?
SPF (Sender Policy Framework) is a DNS TXT record that lists the servers allowed to send email for your domain. When Gmail or Outlook receives a message “from” billing@yourcompany.com, it looks up that domain's SPF record to check whether the sending server is on the list.
What is DMARC?
DMARC is a TXT record at _dmarc.yourdomain. It tells receiving servers what to do with mail that fails SPF/DKIM:
- p=none: monitor only — spoofed mail is still delivered.
- p=quarantine: send spoofed mail to spam.
- p=reject: refuse spoofed mail outright.
The rua=mailto:... tag sends you aggregate reports showing who is sending mail with your domain.
Why email spoofing hurts your brand
- Scammers email your customers or partners as you and ask them to pay into a different bank account.
- Customers get fake login links, lose their accounts, and blame your brand.
- Since 2024 Gmail and Yahoo require bulk senders to have SPF/DKIM and DMARC; without them your real email is more likely to land in spam.
Example DNS records
SPF — pick exactly one line for your email provider (Host @, type TXT):
v=spf1 include:_spf.google.com ~all # Google Workspace / Gmail v=spf1 include:spf.protection.outlook.com ~all # Microsoft 365 v=spf1 -all # domain never sends email
DMARC — start with p=none to monitor, then move to quarantine after 2–4 weeks with no legitimate mail affected (Host _dmarc, type TXT):
v=DMARC1; p=none; rua=mailto:dmarc@example.com v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com
A domain may have only one SPF record. If you use several senders (say Google Workspace plus a newsletter tool), merge their include: entries into a single record; SPF allows at most 10 DNS lookups.
How to add the records
- Log in to wherever your domain's DNS is managed (Cloudflare, your registrar or your host).
- Add a TXT record with the Host and value shown above.
- Wait a few minutes to a few hours for DNS to update, then run the check again.
This tool checks SPF and DMARC. DKIM lives under a provider-specific “selector”, so it can't be checked from the outside — turn it on in your Google Workspace or Microsoft 365 admin console.
Check your whole site, not just one thing
The free scan checks SSL, email spoofing, security headers, exposed sensitive files, outdated CMS and signs of hacking in one go, with plain-language fixes.
Free once you verify your domain: weekly re-scans and email alerts for new issues. PRO ($8/month): deep scan with 5,000+ known-vulnerability checks, deep re-scans up to 10 times a day and 5-minute uptime monitoring.
FAQ
Do I need both SPF and DMARC?
Yes. SPF only declares which servers may send; without DMARC, receiving servers may still deliver spoofed mail. DMARC is what tells them to reject it or send it to spam.
My domain doesn't send email. Do I still need SPF and DMARC?
Yes, because it can still be spoofed. Publish v=spf1 -all as SPF and v=DMARC1; p=reject as DMARC to say the domain never sends mail.
Is DMARC p=none enough?
No. p=none only monitors; spoofed mail still gets delivered. Use it for a few weeks to read the reports, then move to p=quarantine and finally p=reject.
Does this check DKIM?
No. DKIM records sit under a selector that differs per email provider and can't be guessed from outside. Enable DKIM in your email provider's admin console.