Resources · Free tool
Is your domain letting anyone send as you?
Most business domains publish enough information for a stranger to work out whether they can forge your email. This reads the same public records an attacker would, and tells you what they say — SPF, DKIM, DMARC, mail routing and certificate expiry. No signup, no email address, no sales call.
Check a domain
Enter any domain you own or administer. Results in a few seconds.
What this checks — and what it deliberately doesn’t
It reads: your MX records (where your mail goes), your SPF record (which servers may send as you), DMARC (what receivers should do when a message fails), evidence of DKIM signing keys, and the expiry date on your website’s TLS certificate.
It does not: scan ports, probe for vulnerabilities, attempt any login, or send mail. The only connection it makes to you is the same TLS handshake a visitor’s browser makes — enough to read the certificate you already present to everyone, and nothing more. Every record it reads is published by the domain owner for the whole internet to resolve — it is the same lookup every mail server on earth performs before delivering a message to you.
That line is deliberate. A tool that quietly port-scans whatever you type into it is a tool that gets its operator into trouble, and gets you into trouble for using it. This one stays on the public-record side of the line, on purpose.
A word on what the result means. This is a point-in-time reading of public records, offered for information. DNS changes, and a clean result here is not a security audit, not a penetration test, and not a warranty that your email cannot be spoofed — authentication records are one control among many. Read it as a starting point for a conversation, not as a certificate of health. Use it on domains you own or administer, or with the owner’s permission; see our Terms of Use.
Why these four records matter
SPF lists the servers allowed to send mail using your domain. Without it, or with a record that ends in a shrug, a receiving server has nothing to compare an incoming message against.
DKIM signs each message with a key published in your DNS, so a receiver can tell the message was not altered and really came from a system holding your key.
DMARC is the instruction that ties the two together: it tells a receiving server what to do when a message claiming to be from you fails those checks — and, just as usefully, sends you reports about who is sending as you. A domain with SPF and DKIM but p=none is watching the door without closing it.
Certificate expiry is the one that takes a website down on a Sunday. It is included here because it is the single most common self-inflicted outage we get called about.
If the result raises something you want a second opinion on, the free 30-minute assessment covers this and the rest of the NIST CSF functions — or just call (949) 916-6444.
