Can someone send email pretending to be your business?
Enter your business domain. We read its public email records and tell you, in plain English, whether fake emails using your name would be blocked. Free, instant, and nothing is stored.
Reads public DNS records only (SPF, DMARC, MX, DKIM, MTA-STS). Nothing is sent to your domain and nothing is stored.
In short
Email spoofing is when someone sends an email that shows your domain in the From line. Two public DNS records decide whether receiving mail servers let it through: SPF lists who may send for you, and DMARC tells receivers what to do with email that fails. A DMARC policy of p=reject is the strongest protection. The Australian Signals Directorate explains the setup in How to combat fake emails.
Common questions
What does this check?
It reads your domain's public DNS records: the mail servers (MX), SPF (which services may send email for you), DMARC (what receiving mail servers should do with email that fails those checks), common DKIM keys and MTA-STS. It does not send anything to your domain and stores nothing.
What does "can be spoofed" mean?
Without a DMARC policy of quarantine or reject, a scammer can send email that shows your domain in the From line, and many receiving servers will deliver it. That is how many fake invoice and payment-redirection emails reach your customers and suppliers.
How do I fix it?
Publish an SPF record that lists the services that send your email, turn on DKIM signing in Microsoft 365 or Google Workspace, then publish DMARC: start with p=none to collect reports, and move to p=quarantine and p=reject once your real email passes. The ASD's guide on combating fake emails (linked above) walks through it.
Does a good result mean my email is secure?
No. It only covers people pretending to be your domain. Stolen passwords, missing multi-factor authentication and compromised mailboxes are separate problems.
Want a person to look?
The free security check covers more than email: a passive look at what your business exposes to the internet, with a one-page result. For help fixing what this tool finds, get a quote.
For developers and AI assistants: the same check is available as JSON at /api/email-check?domain= and as the check_email_spoofing tool on oowl's MCP server at https://oowl.com.au/mcp.