Can a scammer send email as you?
Find out in seconds. Enter your domain and we’ll check whether SPF, DKIM and DMARC are stopping criminals sending email that looks exactly like it’s from you — the scams behind invoice fraud and phishing. Free, no sign-up.
★ Rated 4.9 on GoogleFamily-run since 1995No fix, no fee
Free, no sign-up — just your domain (e.g. 365techies.co.uk), not your email address.
Checking your DNS records…
Want your email locked down?
Checks your public DNS records (SPF, DKIM, DMARC) live via DNS-over-HTTPS. Nothing is stored, and we never see your email.
Also: How we’d fix it
// SEEING IS BELIEVING
What a spoofed email actually looks like
This is the problem in one picture. If your domain isn’t protected, a criminal can send a message like this — and to your customer, it looks completely genuine, because the address really is yours.
Hi,
Please note our bank details have changed. Kindly use the account below for the invoice due this week, and confirm once payment is sent.
Sort code: 00-00-00 Account: 00000000
Many thanks,
Accounts Team
The customer pays the criminal, not you — and the first anyone hears of it is a chased invoice weeks later. An enforcing DMARC policy stops this email ever arriving.
// THE THREE THAT STOP SPOOFING
SPF, DKIM & DMARC, in plain English
SPF
Lists which servers are allowed to send email for your domain — so random servers can’t.
DKIM
Cryptographically signs your emails, so inboxes can prove they really came from you and weren’t tampered with.
DMARC
Ties it together and tells inboxes what to do with fakes — report, spam or reject. The one most businesses are missing, and the one that protects the address people actually read.
Why it matters
Without these, a scammer can email your customers or staff as ‘you’ — the root of invoice fraud and phishing.
Protects everyone
Your customers, suppliers and team all trust email from your domain — these records keep that trust safe.
Quick to fix
Setting them up is fast and behind-the-scenes — no disruption to how you send email.
Want the full picture? See how to protect your business email, what to do about business email compromise, and the businesses we look after.
Prove it — safely, and only to yourself
Want to see how convincing a fake looks? We’ll run an authorised spoofing test: with your permission, we send one harmless demonstration email to your own inbox so you can see it with your own eyes — then we close the hole. We only ever do this to your address, with your say-so, and never to anyone else. It’s the honest version of ‘seeing is believing’.
01202 775566 · help@365techies.co.uk · MON–FRI 9AM–5PM
// GOOD QUESTIONS
Frequently asked
Can someone send an email that looks like it’s from my company?
If your domain has no enforcing DMARC policy, then yes — a scammer can put your exact address in the ‘From’ line and it will reach inboxes looking genuine. Enter your domain in the checker above and it tells you, in plain English, whether that is possible for you right now.
What is email spoofing?
Spoofing is when someone forges the sender address on an email so it appears to come from you — your customers see your name and address, but the message is really from a criminal. It is the technique behind invoice fraud, fake ‘boss’ payment requests and much phishing.
How do I stop my email being spoofed?
Three DNS records, set up correctly: SPF (who may send as you), DKIM (a signature on your mail) and, crucially, an enforcing DMARC policy (p=quarantine or p=reject) that tells inboxes to bin anything that fails. DMARC is the one most businesses are missing, and it is what actually protects the address a person reads.
What is DMARC and do I really need it?
DMARC is the record that ties SPF and DKIM together and tells receiving inboxes what to do with a fake: report it, spam it or reject it. Without it, SPF and DKIM protect the technical ‘envelope’ but not the visible address your customer actually sees — so yes, for a business, it is the one that matters most.
Someone received a scam email pretending to be me — what do I do?
First, tell the people it may have reached not to act on it, and report it (in the UK, forward phishing to report@phishing.gov.uk). Then close the hole so it can’t happen again by getting SPF, DKIM and an enforcing DMARC policy in place. See our guide on business email compromise, or give us a call.
Can you prove my email is vulnerable?
We can, safely and with your permission — an authorised spoofing test sends a harmless demonstration email to your own inbox so you can see for yourself how convincing a fake looks, and then we close the gap. We only ever do this to your own address, with your say-so, and never to anyone else. It is the honest version of ‘seeing is believing’.
My domain isn’t fully protected — can you fix it?
Yes — setting up SPF, DKIM and DMARC correctly is something we do for businesses regularly, usually within a day and with no disruption to your email. See how we’d protect your email or get in touch.
Is it safe to enter my domain?
Completely — we only read public DNS records (the same ones every mail server checks). We don’t see your email, your inbox or any private data, and nothing is stored.
Not protected? We’ll fix it.
Setting up SPF, DKIM and DMARC properly stops scammers using your name — and we do it for Dorset businesses all the time, usually within a day.
01202 775566 · help@365techies.co.uk · MON–FRI 9AM–5PM
// HOW IT WORKS
How to check if scammers can spoof your email
A scammer can send email that looks exactly like it is from you if your domain has no enforcing DMARC policy, and this free checker looks up your live SPF, DKIM, DMARC, MX and encryption records and gives you a plain-English verdict — can your domain be spoofed right now, yes or no — plus the fixes.
Step by step
- Enter your domain — Type your email domain (the part after the @, e.g. yourbusiness.co.uk) into the checker — no email address or password needed.
- Run the check — Press check; the tool looks up your live SPF, DKIM and DMARC DNS records using a secure DNS-over-HTTPS query.
- Read the verdict — See whether your domain is Protected, partly protected or exposed, with a plain-English note on each record.
- Note the gaps — The most common gap is a missing or monitor-only (p=none) DMARC record — that is the hole scammers exploit.
- Get it fixed — If your domain is not fully protected, 365 Techies can set up SPF, DKIM and DMARC properly, usually within a day and with no disruption to your email.
Good to know
How do I know if someone can spoof my email address?
Enter your domain into this checker: if it finds no SPF record, no DMARC record, or a DMARC policy set to p=none, then spoofed email in your name is not being blocked and scammers can impersonate you.
What actually stops my email being spoofed?
An enforcing DMARC policy (p=quarantine or p=reject) on top of a proper SPF record is what stops spoofing — SPF says who may send as you, DKIM signs your messages, and DMARC tells inboxes to reject anything that fails.
The checker says DKIM was not found — is that a problem?
Not necessarily; the tool probes common DKIM selectors, and your provider may use a custom one it can't see, so it is worth confirming with your email provider that your outgoing mail is DKIM-signed.