Free email spoofing, DMARC, and SPF lookup checker
Check if phishers can send fake email from your domain. Inspect live DMARC enforcement, recursive SPF 10-lookup limits, open subdomains, BIMI readiness, and blocklists.
Open /email-spoof-checker with JavaScript enabled to run a live check, or append ?domain=yourbrand.com to share a report link.
Why can scammers still spoof my domain when I have a DMARC record?
Most domains set _dmarc to v=DMARC1; p=none to satisfy basic bulk-sender rules. A p=none policy is monitor-only: Gmail, Outlook, and Yahoo log the failed authentication in XML reports and still deliver or bounce the forged email. Only p=quarantine or p=reject instructs inboxes to block impersonators.
What is the difference between SPF ~all, -all, and ?all?
SPF checks the Return-Path server IP. -all (HardFail) tells gateways to reject unauthorized servers immediately, preventing backscatter bounce floods. ~all (SoftFail) marks unauthorized mail as suspicious and relies on DMARC to block it. ?all (Neutral) and +all allow any server on the internet to send without failing SPF.
What happens if my SPF record exceeds 10 DNS lookups?
Under RFC 7208, receiving mail servers stop evaluating SPF after 10 DNS-querying mechanisms (include, a, mx, ptr, exists, redirect) and return permerror. An SPF permerror causes SPF authentication to fail for every sender on that domain. Migma avoids root SPF bloat by authenticating mail on an isolated bounce subdomain.
Why am I receiving bounce emails for messages I never sent?
That is email backscatter. External spammers forge your address in the Envelope From header when emailing banks or corporate gateways. If your domain lacks SPF -all and DMARC p=reject, those gateways accept the connection and mail the rejection notice back to your inbox.
How do I move from DMARC p=none to p=reject without breaking real emails?
First verify that every legitimate tool sending as your domain (such as Google Workspace, Microsoft 365, or Migma) signs 2048-bit aligned DKIM. Next update _dmarc to p=quarantine; pct=100 while keeping your rua reporting address. Once aggregate reports confirm real mail passes, switch p=quarantine to p=reject.