Can your domain be spoofed?
Someone can send an invoice, a password reset, or a payroll request that appears to come from your domain. Whether it reaches the inbox is decided by three DNS records — and most domains have at least one of them wrong.
Why anyone can put your name on an email
Any mail server on the internet can put your domain in the From line. Nothing about sending email verifies that you own it.
The receiver — Gmail, Outlook, a spam filter — looks up your DNS to ask whether that server was allowed to send as you, and what to do if it wasn't.
That answer is three records you publish. If they are missing, weak, or set to watch-only, the forged message is delivered like any other.
- DMARCWhat a receiver does with mail that fails the check.Set to quarantine or reject. Monitor-only means you are watching forgeries land, not stopping them.
- SPFWhich servers are allowed to send email as your domain.Published, resolvable, and within the lookup limit — an over-limit record fails for everyone, including you.
- DKIMA signature proving a message really left your sender.A live selector with a key that isn't weak or revoked.
The scan checks all three — plus MX, DNS hardening, blacklists, and domain and SSL expiry — then writes the exact record to paste for anything it finds.
A clean result today isn't a clean result next month
Records get edited, senders get added, and reaching a policy that actually blocks forgeries takes weeks of evidence about who sends as you. The scan is a snapshot; monitoring is the part that keeps it true.