Can someone send email as your company?
Check your domain’s SPF, DKIM and DMARC in seconds. You get an instant grade and a plain-English explanation of what to fix.
Reads public DNS records only. Nothing is sent to your mailboxes.
Get the full report with fix instructions
We’ll email you each issue with the exact DNS records to publish, in the order to change them so legitimate mail keeps flowing. For privacy, the report goes only to an address at .
Rather have us fix it? We can usually get SPF, DKIM and DMARC to an A within a few weeks without disrupting your mail.
Talk to an engineerWhy this matters
Most business email compromise starts with a message that looks like it came from you or your CEO: a changed bank account on an invoice, an urgent wire request, a payroll update. SPF, DKIM and DMARC are the three DNS records that let receiving mail servers tell those fakes from real mail. Without an enforcing DMARC policy, the fakes get delivered.
They also affect deliverability. Gmail, Yahoo and Microsoft now expect bulk senders to have all three, and messages from domains without them are more likely to land in spam.
Common questions
What is SPF?
Sender Policy Framework is a DNS record that lists the servers allowed to send email for your domain. Receiving servers use it to spot mail from servers you never authorized.
What is DKIM?
DomainKeys Identified Mail adds a digital signature to every message you send. The receiver checks it against a public key in your DNS, which proves the message really came from you and wasn’t altered.
What is DMARC?
DMARC tells receiving servers what to do when a message claiming to be from your domain fails SPF and DKIM: deliver it (p=none), send it to spam (p=quarantine) or reject it (p=reject). It also sends you reports on who is sending as your domain.
Can someone send email pretending to be my company?
Yes, unless DMARC is enforcing with p=quarantine or p=reject. With no DMARC, or DMARC at p=none, spoofed messages from your domain are delivered normally, which is how most invoice and wire-fraud scams start.
Is this check safe to run?
Yes. It only reads public DNS records that any mail server can see. It doesn’t send email, touch your mailboxes or need any access.
More background: What the Heck Is DKIM and DMARC? · Forte Managed Security