Tools
Can your company’s email be spoofed?
Analyse your domain’s email security settings in seconds: SPF, DKIM, DMARC, MTA-STS and DNSSEC. You’ll see whether a third party can send email that appears to come from your company, and what to fix.
What we check
Three records that decide whether a fake email reaches the inbox
Domain spoofing is behind many email frauds: invoices with changed bank details, urgent transfer requests or links to fake sign-in pages. Three DNS records decide whether the recipient’s mail servers can detect it.
SPF
Lists the servers authorised to send email on behalf of the domain. There must be a single record that includes every service that sends (corporate email, CRM, invoicing, newsletters) and stays within the ten DNS lookups the standard allows.
DKIM
Cryptographically signs every email sent. The receiver checks the signature against the public key published in DNS and verifies the message comes from the domain and wasn’t altered on the way.
DMARC
Tells the receiver what to do with an email that fails both SPF and DKIM: deliver it (none), send it to spam (quarantine) or reject it (reject). It also sends reports showing who is sending email on behalf of the domain.
Moving to “reject” without losing legitimate email
Tightening DMARC without first reviewing every service that sends on behalf of the domain can block invoices, notifications or newsletters. We analyse the reports, adjust SPF and DKIM for each service and apply the policy in stages.