Free tool · about 30 seconds
Can scammers send email as your office?
Enter your office's email domain. We check its public anti-spoofing settings and look for lookalike domains that scammers use to fake wiring instructions.
Run the check
What this checks
DMARC tells other mail servers what to do with email that pretends to be from your domain. Only "quarantine" or "reject" actually stops it.
SPF lists the services allowed to send your email. Ending it with "-all" tells receivers to refuse everyone else.
DKIM signs your outgoing email. We look for the signing keys Microsoft 365 and Google Workspace use; other providers use names we can't guess, so "not found" isn't always a problem.
Lookalike domains are names one typo away from yours. If one is registered and can handle email, a scammer can use it to send fake wiring instructions that look real at a glance.
This is an automated first look, not a full assessment. A Closing Security Check also covers sign-in security, hidden forwarding rules and your wire-verification steps.