Can someone send email as your domain? Here's how to check.

By default, email lets anyone put your domain in the "From" line, and nothing checks whether it's really you. You can find out how exposed you are in about five minutes. Here's what to look for, and what it means.

What "email spoofing" actually is

Email was built in a more trusting era, and the "From" line is still just text the sender types. By default, nothing proves it's real. Three DNS records fix that: SPF, DKIM and DMARC. When they're missing or half-configured, anyone can send mail as you, and the recipient has no reliable way to tell it's fake. That's where invoice fraud, wire fraud, and the "urgent request from the CEO" usually start.

How to check your domain in a few minutes

You only need your domain name. Use a lookup site (search "yourdomain.com SPF check" or "DMARC check") or run a couple of commands.

1. Check your SPF record

# Windows
nslookup -type=txt yourdomain.com

# Mac / Linux
dig txt yourdomain.com +short

Look for a record starting v=spf1. No SPF record at all is a red flag. Ending in -all (hardfail) is strict; ~all (softfail) and ?all (neutral) are weaker.

2. Check for DKIM

DKIM cryptographically signs your outgoing mail. It lives at a provider-specific "selector," so your email provider's admin console (or an exposure scan) is the reliable way to confirm every sender is signing.

3. Check your DMARC record — and the policy

# Windows
nslookup -type=txt _dmarc.yourdomain.com

# Mac / Linux
dig txt _dmarc.yourdomain.com +short

Look for v=DMARC1, then read p=:

  • p=none — "monitor only." Reports forgeries but blocks nothing.
  • p=quarantine — failing mail goes to spam.
  • p=reject — forged mail is rejected. This is the goal.

No DMARC record at all means your domain is fully exposed.

The gaps you won't spot from the inbox

  • DMARC stuck at p=none for months — the most common gap.
  • SPF over its 10-lookup limit, failing silently with a permerror.
  • Legitimate senders not covered — flip to enforcement without them and you block your own mail.

How to actually stop spoofing (in the right order)

  1. Turn on DMARC reporting and watch real data for a couple of weeks.
  2. Authenticate every legitimate sender with SPF and DKIM.
  3. Move DMARC to enforcement (p=reject) in stages.
  4. Keep it correct as senders, tools and standards change.

Frequently asked questions

Does having an SPF record mean my domain is safe from spoofing?

No. SPF alone covers one sending path and says nothing about what a receiver should do when a check fails — that's DMARC's job. Without DMARC at enforcement, a forged email can still reach inboxes even if you have SPF.

What does DMARC p=none mean?

p=none is 'monitor only.' DMARC will report on mail that fails authentication, but it tells inbox providers to take no action — so impersonators are not blocked. Real protection requires moving the policy to p=reject once your legitimate senders are authenticated.

The fast way: a free exposure scan

StopForge's free exposure scan reads your live records and shows exactly where your email authentication stands — what passes, what silently fails, and whether anyone can still send as your domain. No changes to your mail, no obligation.

See if your domain can be spoofed

Related guides: DMARC p=none vs p=reject: which policy actually protects you? · SPF "too many DNS lookups": what it means and how to fix it

← All guides