Could someone send email as your company?
Enter your email domain (the part after the @) and we'll check whether your business is protected against spoofing. This is how most invoice fraud starts.
Looks up your public SPF, DKIM and DMARC records. We never see your email.
Why this matters
Email was designed before anyone worried about fraud, so by default anyone can send a message that appears to come from your address. Criminals use that to email your customers with "updated bank details", or to email your own staff pretending to be the boss. Three public DNS records, called SPF, DKIM and DMARC, close that door. Most small businesses have one of the three at best.
The three records in plain English
- SPF is a list of the servers allowed to send email for your domain, such as Microsoft 365, Google or your accounts software.
- DKIM adds a digital signature to every message so receivers can tell it hasn't been forged or altered.
- DMARC tells the world what to do with messages that fail those checks: deliver them anyway, send them to spam, or reject them. It also sends you reports so you can see who is pretending to be you.
A nice side effect
Gmail, Microsoft and Yahoo now expect these records from businesses that send email. Getting them right means your own legitimate email is far less likely to land in customers' junk folders.
Common questions
What's the difference between SPF, DKIM and DMARC?
SPF lists who may send for you, DKIM signs each message to prove it's genuine, and DMARC tells receivers what to do when a message fails those checks and sends you reports. You need all three for proper protection.
We use Microsoft 365. Aren't we already protected?
Microsoft sets up part of it, but DMARC and often DKIM are left to you. Many Microsoft 365 and Google Workspace domains still have DMARC in monitor-only mode or missing altogether.
Will tightening DMARC stop our own email being delivered?
Not if it's done properly. We find every service that sends as your domain first, including things like accounting software and newsletters, add them to SPF and DKIM, then tighten DMARC in stages while watching the reports.
How long does it take to fix?
Usually a couple of hours of work spread over two or three weeks, because the final tightening step should wait until the reports confirm nothing legitimate is failing.