Free tool
Email spoofing risk checker
Email spoofing is when a message is sent with your domain in the From address by someone who is not you. Whether it succeeds depends on your SPF and DMARC settings. This checker reads those settings and tells you, in plain language, how easy spoofing is.
What this checks
- SPF presence and strictness
- DMARC presence and enforcement level
- DKIM at common selectors
How to use it
- Run the check.
- If DMARC is missing or p=none, follow the generated fix.
- Re-run after each change.
Methodology and limitations
This estimates configuration-based risk. It does not send test emails and cannot see how every receiver treats your mail. PixelPrivate performs passive checks against publicly visible configuration only. It does not test for exploitable vulnerabilities, so a clean result is not a guarantee of security. Read the full security methodology.
Key terms
- Domain spoofing — Domain spoofing is sending email that forges your exact domain in the From address, without having access to your email accounts..
- DMARC — DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS record that tells receiving mail servers what to do with email that claims to be from your domain but fails SPF and DKIM checks..
- Phishing — Phishing is a fraud technique where attackers send messages or build websites that impersonate a trusted organization to trick people into revealing credentials, payment details or into installing malware..
Frequently asked questions
Is spoofing the same as hacking my email account?
No. Spoofing forges the sender name without access to your mailboxes. Account takeover is a separate problem addressed with MFA.
Monitor this domain continuously with PixelPrivate.
Create a free account to re-check automatically, keep your DKIM selectors, and get alerted when SPF, DKIM, DMARC or MX records change.
Create free account