InboxInstant, then a second look
Inbox triage testWhich emails in this list actually need you?
Paste the subject lines in your inbox. Get them sorted into what needs you, what can wait and what a machine sent, with the reason for each.
Can someone send email as this domain?
If a domain has no DMARC record, or one set to p=none, a stranger can usually send email that appears to come from it. Type a domain and this reads its public SPF, DKIM and DMARC records, gives a verdict with the raw records behind it, and shows the exact DNS entries that fix it. A free tool from Mailient.
- Free
- No account
- Public DNS only
- About two seconds
What you paste
Three steps, no sign-up
Type your domain
Something like yourcompany.com. An email address or a full web address works too; we take the domain from it.
We read its public DNS
SPF, DMARC, mail routing and nameservers, plus DKIM at 15 common selectors. These are records anyone can look up, and no email is sent at any point.
Get a verdict and the fix
A plain answer, the raw records behind it, a mockup of what a forged email would look like, and the exact DNS records to add. The result has its own page you can send to whoever manages your DNS.
What you get
What it reads, and what it decides
No model is involved. The verdict is rules applied to records anyone could look up, and the raw record is shown under each finding so you can check it.
| Part | Where it comes from | What it tells you |
|---|---|---|
| SPF | Public DNS | Which servers may send for your domain and how strictly: hard fail, soft fail, or anyone. Read from the TXT record at the domain. |
| DKIM | Public DNS | Whether outgoing mail is signed. Probed at 15 common selectors; finding none does not prove there is no key. |
| DMARC | Public DNS | What receiving servers are told to do with mail that fails: nothing, quarantine or reject. This is the record that decides the verdict. |
| Mail routing | Public DNS | Whether the domain receives mail at all, and through which provider when it is one we recognise (Google Workspace, Microsoft 365, Zoho, Proton, Mailgun, ImprovMX, Fastmail). |
| Verdict and grade | Fixed rules | Set by the DMARC policy: no record is an F, monitor-only a D, quarantine a C, reject a B. A reject policy earns an A only if SPF is set to hard fail and a DKIM key was found. |
| The fix | Fixed rules | Copy-paste DNS records for what is missing or weak, with a note on the safe order to apply them. |
Reading it
How to read the result
Read the DMARC line first; it decides the verdict. No record is an F and p=none is a D: in both cases a receiving server that spots a forged message has no instruction to reject it, and usually delivers it. Quarantine is a C and reject a B. Reject earns an A only with SPF set to hard fail and a DKIM key found.
SPF lists the servers allowed to send for the domain. A soft fail (~all) or neutral (?all) ending only flags mail from other servers; a hard fail (-all) tells receivers to refuse it. DKIM shows whether outgoing mail is signed, and “not found” means none of the 15 selectors we tried answered, not that there is no key.
The fix lists copy-paste records in a safe order: start DMARC at p=none with a reporting address, confirm your own mail passes, then move to quarantine and reject. The result has its own page, so you can send it to whoever manages your DNS.
Background
Why it works this way
Why this is possible at all
Email was designed in the early 1980s without any way to prove who sent a message. The From line is text. Anyone can type anything into it, and the protocol has no opinion about whether it is true.
Three DNS records were added later to patch that. SPF lists the servers allowed to send for your domain. DKIM cryptographically signs what you send. DMARC is the one that matters most, because it tells receiving servers what to do when a message fails those checks, and without it the usual answer is to deliver it anyway.
Plenty of domains have none of this, or have a DMARC record left in monitoring mode from the day it was set up. That is not negligence. It is a genuinely obscure corner of infrastructure that nobody owns at a company of five people.
What it is actually used for
The common attack is dull and effective: a supplier invoice arrives with changed bank details, from an address the recipient recognises. It works because there is nothing to notice. The domain is genuine, the display name is right, and the only thing wrong is the account number.
The second use is quieter. Your own legitimate email is more likely to be filtered when your domain has no authentication, because the same records are what receiving servers use to decide you are trustworthy.
How common is this?
Common enough that we measured it rather than guessing. We checked the public DNS of the top 50,000 sites, and of the 36,548 that actually receive email, 47.9% publish no DMARC policy that would stop a forged message being delivered. That sample is the most-visited sites, so it says little about how a typical small company is set up.
The method, the things we could not measure, and the per-domain results as a CSV are all published with it, so none of that has to be taken on trust. Read the research, or download the per-domain results as a CSV.
Limits
What it cannot tell you
Every tool here is a first pass with edges. These are this one's.
- A missing DKIM key does not mean there is none. Keys live at a name chosen by your email provider, and there is no way to list them. We try 15 common ones. Your provider can tell you yours in a minute.
- It shows whether someone could, not whether anyone has. For evidence of actual attempts you need DMARC reports, which the fix tells you how to switch on.
- A result can be up to a day old. Result pages are cached for 24 hours, and a DNS change takes anywhere from a few minutes to a few hours to spread.
- It reads authentication, not deliverability. It does not send a test email or check where your mail lands.
- Unused domains are not graded. A domain with no nameservers, or with nothing running on it, is reported as exactly that instead of being handed a grade.
Beyond the sample
When this is not enough
This shows what can be sent in your name. It cannot show whether anyone has actually tried; for that, switch on DMARC aggregate reports, which the fix explains.
Mailient handles the other direction: what arrives in your Gmail. Its Today view shows the emails that need a decision today, today's meetings, and threads you sent that got no reply. It drafts a reply in your writing voice when you ask, and by default sends nothing until you approve it.
Your data
What we keep
Read off the code that does it, not written from memory.
- In your browser
- Checks that what you typed looks like a domain.
- Sent to our server
- The domain name. We read its public DNS records from our server.
- Sent on to a model
- None. The verdict is rules applied to the DNS records.
- What we keep
- The domain, its grade and when it was checked, only if it receives mail; that is what gives the result its page. If you choose to be told when it changes, your email address as well, until you unsubscribe.
Read from lib/spoof-index.ts, app/api/domain-watch/route.ts and lib/rate-limit.ts.
Questions
Questions people ask, answered plainly
6 answers, grouped. Each one is written against what the tool actually does.
How it decides
What does it mean that anyone can send email as my domain?
Email has no built-in proof of who sent it. The From line is just text, so anyone can type your address into it. Three DNS records exist to fix that: SPF lists which servers may send for you, DKIM signs your outgoing mail, and DMARC tells receiving servers what to do when something fails those checks. Without DMARC set to quarantine or reject, a forged message is usually delivered.
Why does p=none not protect me?
Because it means monitor only. The receiving server checks the message, notices it is forged, and delivers it anyway, because that is what your policy instructs. It is the standard starting point when DMARC is set up, and many domains are left there and never moved on to quarantine or reject.
You said no DKIM key was found. Do I definitely not have one?
No, and the result says so. DKIM keys live at a name chosen by your email provider, called a selector, and there is no way to list them. We try 15 common ones (google, selector1, selector2, k1, k2, dkim, mail, s1, s2, default, mandrill, zoho, fd, pm and mailjet). Finding nothing means we could not guess yours, not that you have none. Your email provider can tell you in a minute.
Fixing it
What should my DMARC policy be?
Start at p=none with a reporting address, so you can see who sends as your domain without changing delivery. Once the reports show your own mail passing, move to quarantine, then to reject. Going straight to reject can bounce your own newsletters and invoicing tools if any of them is not set up yet.
Your data
What do you store when I check a domain?
The domain, its grade and the time it was checked, but only when the domain receives mail. That record is what gives the result its own page and its place in our sitemap. The record holds nothing about who checked it, and nothing is sent to anyone. If you choose “Tell me if this changes”, we also keep your email address, described below.
Mailient
Is this what Mailient does?
It is the other direction. This checks what can be sent in your name. Mailient works on what arrives in your Gmail: its Today view shows the emails that need a decision today, today's meetings, and threads you sent that got no reply; it drafts a reply in your writing voice when you ask; and by default it sends nothing until you approve it.
More free tools
Try another one
WritingTwelve seconds a round
Spot the defaultWhich reply was written with a voice profile?
Two replies to the same email, both written by AI. One had a voice profile and one had none. You have twelve seconds to say which.
WritingInstant, then a few seconds
Writing voice analyserWhat does your writing voice actually look like?
Paste two emails you have sent. Get your writing fingerprint, measured from the text rather than guessed, and one new email in your voice.
This is the sample. Mailient does this on Gmail.
This tool reads public DNS for a domain you type. Mailient does the same kind of reading on your Gmail: it shows what needs a decision today, drafts in your voice when you ask, and by default sends nothing until you approve it.