Email Spoof Check
Check whether a domain has SPF and an enforced DMARC policy in place, the two records that stop attackers from sending e-mail in its name.
- Runs on our servers
- Free to use
- API available →
About this tool
E-mail spoofing, sending messages that appear to come from your domain, works whenever receivers have no way to verify the sender. The Email Spoof Check queries the SPF and DMARC records of a domain, parses them, and turns the result into a clear verdict: not spoofable, possibly spoofable or spoofable, with the exact reason and any syntax issues found.
Run it on your own domains and on partners you exchange invoices with. The DMARC Lookup and TXT Lookup show the individual records in detail to help identify potential email security issues.
How to use it — quick steps
- 01
Enter the domain or hostname
Type or paste the domain or hostname in the field above, for example example.com. Use Ctrl + V to paste.
- 02
Press "Check domain"
Press "Check domain" or Ctrl + Enter. The result appears below in a few seconds. Results can be copied.
- 03
Read the result
It appears in the dark panel under the form in a few seconds. Every block has [copy] and other actions.
Key features of this tool
Spoofability verdict
Not spoofable, possibly spoofable or spoofable, with the reason in plain words.
SPF and DMARC parsed
Records, the SPF all qualifier, DNS lookup count, policy and enforcement status.
Issues listed
Syntax and configuration problems reported by the validators with their severity.
Frequently asked questions
What makes a domain "not spoofable"?
An SPF record that lists its senders and ends with -all or ~all, plus a DMARC record with p=quarantine or p=reject. Receivers then discard mail that fails authentication.
We have SPF, is that enough?
No. Without DMARC, SPF failures are only a hint; most receivers still deliver the message. DMARC is what tells them to reject it.
Why does DKIM not appear?
DKIM lives on per-selector records that cannot be discovered without knowing the selector. SPF and DMARC are the discoverable half of the puzzle and enough for a spoofability verdict.
Where does the data come from?
The APIVoid SPF Validator and DMARC Validator APIs.