Can your domain be spoofed?
Attackers put your domain in the From line of phishing and invoice-fraud emails. In seconds, see whether yours would reach inboxes - graded straight from your public DNS. No login, nothing to install.
What this checks
Email spoofing is stopped by how your domain is configured, not by luck. This tool grades the parts that matter and shows you exactly what an attacker could exploit today.
- DMARC enforcement - the control that actually blocks forged mail. A record set to
p=nonelooks like protection but blocks nothing. - SPF - whether unauthorised senders are rejected or quietly let through.
- Lookalike domains - live typosquat and homograph variants of your domain that could impersonate you, which DMARC cannot stop.
- Hardening signals - MTA-STS and BIMI, the marks of a mature setup.
This is a posture check: it shows what your configuration allows, not whether you are being attacked right now. To see real impersonation attempts as they happen, add our free DMARC Monitor.
Frequently asked questions
Can my domain be spoofed?
If your domain has no DMARC record, or a DMARC policy of p=none, attackers can put your exact domain in the From line of phishing emails and it can still reach inboxes. This free checker grades your exposure from public DNS in seconds and shows exactly what to fix.
What is business email compromise (BEC)?
BEC is a targeted scam where an attacker impersonates a trusted person or company by email to trigger a fraudulent payment or data disclosure. It uses either your exact domain (stopped by DMARC enforcement) or a lookalike domain (which DMARC cannot stop), both of which this tool checks.
Does SPF stop email spoofing?
No. SPF validates the sending server, not the visible From address, so SPF alone never stops someone forging your domain in the From line. Only DMARC set to p=quarantine or p=reject instructs receivers to block forged mail. This tool grades your DMARC policy, not just SPF.
What does the grade (A to F) mean?
The grade reflects how hard it is to forge your exact domain, based on your DMARC policy, SPF, live lookalike domains and hardening signals. It describes what your public DNS configuration allows - your exposure - not a claim that anyone is spoofing you right now. To see real impersonation attempts as they happen, add our free DMARC Monitor.
Is this a penetration test?
No. This is an email-security posture check. It reads only your public DNS - it never sends mail to your domain and never attacks anything. It shows what your configuration allows. A full posture assessment and any red-team-style testing are separate, scoped engagements.
My domain scored an A. Am I fully protected?
No email configuration is ever 100% safe. A strong grade means direct forgery of your exact domain is blocked, but display-name spoofing (someone using your name from another address) and lookalike domains remain possible. Those residual risks are covered in a full Email Security Posture Assessment.
Do you store my domain or email address?
The grade check is anonymous - we read only public DNS and keep an aggregate count of domains checked. Your email address is stored only if you ask us to email the full report, with a consent line, and is retained under our privacy policy.
The check shows what to fix. We fix it for you.
Postbox Services runs email security and deliverability for businesses: anti-spoofing hardening, BEC defence, DMARC enforcement, and full posture assessments.