Can someone fake your company's email?

Check for free in 10 seconds: type your website or your email and see whether someone could send email in your name.

For example:
  • Free, no sign-up
  • Works for any company, a supplier's too
  • We only read public records: nothing is sent or changed
What the result looks likeExample

Can someone send email pretending to be yourcompany.com?

Yes

Anyone can send email that looks like yours, and many inboxes will deliver it. That's how fake invoices in your name arrive.

Why: there's no DMARC policy.

Free 20-minute call

I'll fix it, if you like: from €290 (excl. VAT)

We look at the same things Gmail and Outlook use to decide whether an email really comes from you.

  • SPF
  • DKIM
  • DMARC
  • MX
  • MTA-STS
  • TLS-RPT

Why it matters

This is how a fake invoice starts

Someone writes to your client from an address identical to yours: “We've changed banks, please pay this invoice into this account.” If your email isn't protected, the message lands in the inbox with your name on it, without any warning.

  • Your client pays a different account. And the money rarely comes back.
  • Your name signs the scam. Phishing aimed at your clients and suppliers, in your company's name.
  • Your real emails end up in spam. Gmail, Yahoo and Microsoft already require these protections from anyone who sends a lot of email.
From:
Accounts <accounts@yourcompany.com>
To:
sarah@client.com
Subject:
Change of bank account

Hi Sarah,

From this month on, please pay our invoices into our new account: GB00 0000 0000 0000 0000 00. October's invoice is attached.

Thanks.

The sender is exactly your address. Without protection, Sarah's inbox can't tell it's fake.

How it works

Three steps, and the first takes ten seconds

  1. Type your website or email

    yourcompany.com, www.yourcompany.com or anna@yourcompany.com all work. You don't need to know what a domain is.

  2. We answer: Yes, Partly or No

    Whether someone can pretend to be your company, why, and what to fix first. No jargon.

  3. You, your IT person or I fix it

    Send the result link to whoever runs your email, or book a free 20-minute call.

What we check

Six questions about your email, in plain English

  • Is spoofing protection switched on?DMARC
  • Who can send email in your name?SPF
  • Are your messages signed?DKIM
  • Can people email you?MX
  • Is email encrypted on the way?MTA-STS
  • Do you hear when delivery fails?TLS-RPT
For technical readers: details and advanced options

We look up MX, SPF (with the DNS lookup count and the final mechanism), DKIM on the common selectors and your provider's, DMARC (p, sp, pct, t), MTA-STS and TLS-RPT. Each result has its own URL and shows every record in the full breakdown.

JSON API: GET /api/tools/email-dns-audit?domain=yourcompany.com

Leave it blank and we'll try the common ones and your provider's.

Bernat Barroso

Who's behind it

I'm Bernat Barroso

CTO since 2019, with more than ten years building and securing systems, working remotely from Barcelona. I built this tool so any company can find out in seconds whether its email can be spoofed. If something needs fixing, I'll explain it without jargon.

Frequently asked questions

Is it really free?

Yes, and no sign-up. If you want help, the first call is free too. The fix, if you want it, has a fixed price from €290 (excl. VAT).

We use Gmail or Outlook at work. Aren't we protected already?

Not necessarily. Google and Microsoft protect their own service, but the protection against someone impersonating your company is switched on in your domain, and often nobody has switched it on.

Does it change anything on my website or email?

No. We only read public information, the same any mail server checks before delivering a message.

Can I check another company?

Yes, it's public data. It's useful with a supplier who sends you invoices: if their email can be spoofed, be wary of any change of bank account.

My result says “Yes”. What now?

It's worth fixing this week. Send the result link to your IT person, or book the free call and I'll tell you what to change and in what order. It's usually fixed without changing email provider.

What are SPF, DKIM and DMARC?

Three settings on your domain. SPF is the list of who may send in your name, DKIM is a signature on every message, and DMARC tells inboxes what to do with mail that fails: let it through, send it to spam or reject it.

Check it now? It takes ten seconds.

Would you rather I looked at it myself? Book the free call

Check my email