Free tool

Can scammers send email as your domain?

Checks SPF and DMARC (email spoofing protection), who handles the domain’s email, and when the domain registration expires.

Why SPF and DMARC matter

SPF lists the services allowed to send email for a domain. DMARC tells receiving mail servers what to do with email that fails those checks: deliver it anyway (p=none), send it to spam (p=quarantine) or reject it (p=reject).

Without them, anyone can send email that looks like it comes from your domain, which is how most invoice and password-reset scams work. Real email from you is also more likely to land in spam, and Gmail and Yahoo now require DMARC from bulk senders.

An expired domain is worse still: the website and every email address on it stop working at once, and after a short grace period someone else can register it.

This is one of 50+ checks in a full audit

Run the complete audit free: SEO, speed, security, a 50-page crawl, AI visibility and email security, with a step-by-step fix plan for your platform. Share it with your clients under your own brand.

Run a full audit free