Can someone send email pretending to be you?
Check your domain's SPF, DMARC and DKIM in seconds, explained in plain English. Free, no sign-up.
What this checks
- DMARC, the setting that decides whether fake email using your domain gets delivered, sent to spam or rejected. It matters most.
- SPF, the published list of services allowed to send email as your domain.
- DKIM, the digital signature that proves an email really came from you and wasn't changed on the way.
- Where your email is handled, such as Microsoft 365 or Google Workspace.
Why it matters
If your domain can be spoofed, a criminal doesn't need to hack you to send your customers a fake invoice or bank detail change. The email simply arrives looking like it's from you. Getting DMARC to enforcing is one of the cheapest, most effective fixes a business can make.
A good result here doesn't mean nobody can get into your mailbox, though. That's about passwords, multi-factor authentication and staff awareness. If you think an account has already been taken over, read what to do if your business email is hacked.
Getting it fixed
Fixing SPF, DKIM and DMARC is usually a few hours of careful work, done in stages so your own email keeps arriving. Follow my step by step DMARC guide to do it yourself. I can do it for you, alongside your IT provider, or as part of Cyber Essentials.
Email security questions
What do SPF, DMARC and DKIM actually do?
SPF lists the services allowed to send email as your domain. DKIM adds a tamper-proof signature to each email. DMARC ties them together and tells other mail servers what to do with email that fails, such as sending it to spam or rejecting it, and sends you reports.
Why does it matter if my domain can be spoofed?
Without DMARC enforcing, criminals can send email that appears to come from your exact address. It's the easiest way to send your customers fake invoices or bank detail changes, and many cyber insurers and larger customers now check for it.
Is DMARC set to p=none good enough?
It's a sensible first step, because it shows you who is sending email as your domain. But it doesn't block anything. The goal is quarantine or reject, once you're confident your own email passes.
Can fixing this break my email?
It can if it's rushed. Jumping straight to a strict DMARC policy before every service that sends email for you (your accounts package, CRM, newsletters) is set up can stop your own email arriving. That's why it's done in stages.
Do you see or store the domains I check?
No. The check runs in your browser, which asks Cloudflare's public DNS service for the records directly. The domain is never sent to fromIT.
Want it fixed properly?
Book a 30 minute call and I'll go through your result with you. No obligation, no sales script.