Free tool · Spot fraud
Email spoofing checker (SPF, DKIM, DMARC)
Enter a supplier's domain or email address to see whether someone else could send email that looks like it came from them. We check SPF, DKIM and DMARC and explain what we find in plain English.
Why email spoofing matters to a finance team
Email was designed without any built-in way to prove who sent a message. The From line is just text, and anyone can type anything into it. Invoice and mandate fraud relies on this: a fraudster sends an email that appears to come from a supplier you already pay, saying their bank details have changed. If it reaches your inbox looking genuine, the next payment goes to the fraudster.
Three DNS records let a domain's owner tell the world's mail servers which emails are really theirs. They only help if the owner has set them up properly, and many small businesses haven't. This checker shows you, for any domain, how much protection is in place.
SPF: who is allowed to send
SPF (Sender Policy Framework) is a TXT record listing the servers allowed to send email for the domain, such as Microsoft 365, Google Workspace or an invoicing system. It ends with an 'all' rule saying what to do with everything else. -all means reject, ~all means accept but mark as suspicious, and ?all or +all mean no protection at all. A domain must have exactly one SPF record, and checking it must take no more than 10 DNS lookups. Break either rule and receiving servers treat SPF as broken.
SPF on its own has a big gap. It checks the hidden 'envelope' sender used by mail servers, not the From address you see in your inbox. A fraudster can pass SPF with their own domain while showing your supplier's name and address in the From line.
DKIM: a signature on each message
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every outgoing email. The public key sits in DNS under a 'selector' name chosen by the sender, such as selector1 for Microsoft 365 or google for Google Workspace. Because selectors can be anything, there's no way to list them all from outside. We try the most common ones. If we don't find a key, the domain may still use DKIM under a name we didn't guess. You can find the real selector in any email from the domain: look in the message headers for DKIM-Signature and the value after s=.
DMARC: the policy that actually stops spoofing
DMARC ties SPF and DKIM to the From address you see, and tells receiving servers what to do when an email fails: p=reject (refuse it), p=quarantine (send it to spam) or p=none (deliver it anyway and just send the owner a report). Only quarantine and reject stop spoofed mail. p=none is a monitoring setting, normally used while a business checks that all its genuine email passes before switching enforcement on. Plenty of domains set p=none and never move on.
Other tags matter too. pct= applies the policy to only a percentage of failing mail. sp= sets a separate policy for subdomains. If a subdomain such as billing.supplier.co.uk has no DMARC record of its own, receivers fall back to the record on supplier.co.uk.
How we reach a verdict
- Well protected: DMARC is set to quarantine or reject for all mail, and SPF is valid. Forged emails from this exact domain should be blocked by most providers.
- Partly protected: some protection is in place but has gaps, such as an enforcing DMARC policy on only part of the mail, or a strict SPF record with DMARC left at monitoring.
- Easy to spoof: there's no DMARC enforcement and SPF doesn't fill the gap. Forged emails may arrive looking genuine.
What a good result doesn't tell you
A well protected domain only stops forgeries of that exact domain. It does nothing if the supplier's real mailbox has been hacked, which is common in invoice fraud, or if the fraudster registers a lookalike domain that's one letter off. Neither of these shows up in DNS checks on the real domain. Whatever the result, the rule for finance teams stays the same: never change a supplier's bank details because of an email. Call them on a number you already hold, not one from the email, and check before you pay.
Your privacy
The lookups go straight from your browser to Cloudflare's public DNS-over-HTTPS resolver (with Google's as a fallback). DNS records are public information. Nothing you type is sent to Paylist.
Frequently asked questions
How can I tell if an email address is being spoofed?
You can't tell for certain from the email alone, because the From line can say anything. Check the sender's domain here: if it's easy to spoof, forged emails may reach you looking genuine. In your email client you can also view the message headers and look at the SPF, DKIM and DMARC results. Either way, verify any payment or bank-detail request by calling the sender on a number you already hold.
What is the difference between SPF, DKIM and DMARC?
SPF lists the servers allowed to send for a domain. DKIM adds a cryptographic signature to each message. DMARC links both to the visible From address and tells receiving servers whether to deliver, quarantine or reject mail that fails. You need DMARC set to quarantine or reject for real protection against spoofing.
Is DMARC p=none enough to stop spoofing?
No. p=none is monitoring only: the domain owner receives reports, but receiving servers are told to deliver failing mail as normal. It's a sensible first step while checking that genuine email passes, but spoofed email still gets through until the policy is changed to quarantine or reject.
Why does the checker say no DKIM was found when my domain uses DKIM?
DKIM keys live under a selector name the sender chooses, and DNS has no way to list them. We try the most common selectors used by Microsoft 365, Google Workspace and popular email services. If yours uses a different name, enter it in the optional selector box. You'll find it in the DKIM-Signature header of an email you've sent, after s=.
What does 'too many DNS lookups' mean for SPF?
Checking an SPF record may take no more than 10 DNS lookups, including those inside every include. Each email service you add usually adds at least one. Go over 10 and receiving servers give up and treat SPF as broken. Our count is an estimate: we follow includes up to a sensible limit.
If a supplier's domain is well protected, can I trust their emails?
Not completely. Good SPF, DKIM and DMARC stop other people forging that exact domain, but not emails from the supplier's real mailbox if it has been hacked, or from a lookalike domain. Always verify a change of bank details by phone on a number you already have.
Does this tool send the domain I check to Paylist?
No. The lookups go directly from your browser to Cloudflare's public DNS resolver, or Google's if Cloudflare can't be reached. Nothing you enter is sent to Paylist.
Check before you pay — every time
Paylist is a verified directory of UK business bank details. Your suppliers list theirs once, and you look them up instead of trusting an email.