Check Your Domain Free

Free Email Spoofing Test

Email spoofing lets attackers send emails that appear to come from your domain — used for phishing employees, customers, and partners. This test checks whether your domain's DNS records prevent spoofing.

Test your domain now — free

Enter your domain to check if it can be spoofed. We check SPF, DMARC, and DKIM configuration.

How email spoofing works

Email protocols were designed before security was a priority. By default, anyone can set the "From" address in an email to any domain. Without SPF, DKIM, and DMARC, there is nothing to stop an attacker from sending emails that appear to be from your company.

A spoofed email looks like this to the recipient

From: ceo@yourcompany.com
Subject: Urgent — wire transfer needed
Body: Please transfer €15,000 to this account today...

The email never touched yourcompany.com's servers. It was sent from an attacker's server with a forged From address.

What makes a domain spoofable

How to prevent email spoofing

  1. Add an SPF record — lists the servers authorized to send email for your domain
  2. Enable DKIM — cryptographic signature proving the email came from your server
  3. Add DMARC — policy that tells receiving servers what to do with failures
  4. Move DMARC to p=reject — fully blocks spoofed emails from reaching inboxes
v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com

Monitor spoofing protection automatically

DNS records can break or be misconfigured after changes. masoSec continuously monitors your SPF, DKIM, and DMARC records and alerts you the moment your domain becomes vulnerable.

→ Start Free Spoofing Protection Monitoring

Frequently asked questions

How do I know if my domain can be spoofed?

Run the test above. If your SPF is missing or your DMARC policy is "none" or absent, your domain can be spoofed. The test checks all three records in seconds.

What is email spoofing?

Email spoofing is forging the "From" address in an email to make it appear to come from a trusted domain. It's the core technique behind business email compromise (BEC) and phishing attacks.

How do I stop my domain from being spoofed?

Set up SPF, DKIM, and DMARC in your DNS. Set DMARC to p=reject. This instructs receiving servers to block any email that fails authentication.

Can I spoof a domain that has DMARC?

A domain with DMARC p=reject and correct SPF/DKIM cannot be effectively spoofed. p=none provides no protection — it only generates reports.