InboxInstant, then a second look
Inbox triage testHow much of your inbox actually needs you?
Paste the subject lines in your inbox. Get them sorted into what needs you, what can wait and what a machine sent, with the reason for each.
Can anyone send email as you?
Type your domain. We read its public DNS records and show whether a stranger could email your customers as you, what that email would look like, and the exact records that stop it.
- Free
- No account
- Public DNS only
- About two seconds
How it works
Three steps, no sign-up
Type your domain
Something like yourcompany.com. An email address or a full web address works too; we take the domain from it.
We read its public DNS
SPF, DMARC, mail routing and nameservers, plus DKIM at 15 common selectors. These are records anyone can look up, and no email is sent at any point.
Get a verdict and the fix
A plain answer, the raw records behind it, a mockup of what a forged email would look like, and the exact DNS records to add. The result has its own page you can send to whoever manages your DNS.
What you get
What it reads, and what it decides
No model is involved. The verdict is rules applied to records anyone could look up, and the raw record is shown under each finding so you can check it.
| Part | Where it comes from | What it tells you |
|---|---|---|
| SPF | Public DNS | Which servers may send for your domain and how strictly: hard fail, soft fail, or anyone. Read from the TXT record at the domain. |
| DKIM | Public DNS | Whether outgoing mail is signed. Probed at 15 common selectors; finding none does not prove there is no key. |
| DMARC | Public DNS | What receiving servers are told to do with mail that fails: nothing, quarantine or reject. This is the record that decides the verdict. |
| Mail routing | Public DNS | Whether the domain receives mail at all, and through which provider when it is one we recognise (Google Workspace, Microsoft 365, Zoho, Proton, Mailgun, ImprovMX, Fastmail). |
| Verdict and grade | Fixed rules | Set by the DMARC policy: no record is an F, monitor-only a D, quarantine a C, reject a B. A reject policy earns an A only if SPF is set to hard fail and a DKIM key was found. |
| The fix | Fixed rules | Copy-paste DNS records for what is missing or weak, with a note on the safe order to apply them. |
Background
Why it works this way
Why this is possible at all
Email was designed in the early 1980s without any way to prove who sent a message. The From line is text. Anyone can type anything into it, and the protocol has no opinion about whether it is true.
Three DNS records were added later to patch that. SPF lists the servers allowed to send for your domain. DKIM cryptographically signs what you send. DMARC is the one that matters most, because it tells receiving servers what to do when a message fails those checks, and without it the usual answer is to deliver it anyway.
Plenty of domains have none of this, or have a DMARC record left in monitoring mode from the day it was set up. That is not negligence. It is a genuinely obscure corner of infrastructure that nobody owns at a company of five people.
What it is actually used for
The common attack is dull and effective: a supplier invoice arrives with changed bank details, from an address the recipient recognises. It works because there is nothing to notice. The domain is genuine, the display name is right, and the only thing wrong is the account number.
The second use is quieter. Your own legitimate email is more likely to be filtered when your domain has no authentication, because the same records are what receiving servers use to decide you are trustworthy.
How common is this?
Common enough that we measured it rather than guessing. We checked the public DNS of the top 50,000 sites, and of the 36,548 that actually receive email, 47.9% publish no DMARC policy that would stop a forged message being delivered. That sample is the most-visited sites, so it says little about how a typical small company is set up.
The method, the things we could not measure, and the per-domain results as a CSV are all published with it, so none of that has to be taken on trust. Read the research.
Limits
What it cannot tell you
Every tool here is a first pass with edges. These are this one's.
- A missing DKIM key does not mean there is none. Keys live at a name chosen by your email provider, and there is no way to list them. We try 15 common ones. Your provider can tell you yours in a minute.
- It shows whether someone could, not whether anyone has. For evidence of actual attempts you need DMARC reports, which the fix tells you how to switch on.
- A result can be up to a day old. Result pages are cached for 24 hours, and a DNS change takes anywhere from a few minutes to a few hours to spread.
- It reads authentication, not deliverability. It does not send a test email or check where your mail lands.
- Unused domains are not graded. A domain with no nameservers, or with nothing running on it, is reported as exactly that instead of being handed a grade.
Your data
What happens to what you give it
Read off the code that does it, not written from memory.
- In your browser
- Checks that what you typed looks like a domain.
- Sent to our server
- The domain name. We read its public DNS records from our server.
- Sent on to a model
- None. The verdict is rules applied to the DNS records.
- What we keep
- The domain, its grade and when it was checked, only if it receives mail; that is what gives the result its page. If you choose to be told when it changes, your email address as well, until you unsubscribe.
Questions
Questions people ask, answered plainly
15 answers, grouped. Each one is written against what the tool actually does.
Using it
What can I type?
A domain such as yourcompany.com, an email address, or a full web address. We take the domain out of whichever you give us and ignore the rest. You do not need to add https:// or www.
How do I fix what it finds?
Add the records shown under “The exact records that fix it” in whichever service manages your domain's DNS. They take from a few minutes to a few hours to take effect. The example SPF record assumes Google Workspace, so swap the include for your own mail provider before you add it.
What should my DMARC policy be?
Start at p=none with a reporting address, so you can see who sends as your domain without changing delivery. Once the reports show your own mail passing, move to quarantine, then to reject. Going straight to reject can bounce your own newsletters and invoicing tools if any of them is not set up yet.
Will fixing this stop my email going to spam?
It helps, often a lot. The same three records are used by receiving servers to decide whether you are trustworthy, so a domain with no authentication is more likely to be filtered. Fixing them is one of the few deliverability changes with a direct, mechanical effect rather than a folk remedy.
How it decides
What does it mean that anyone can send email as my domain?
Email has no built-in proof of who sent it. The From line is just text, so anyone can type your address into it. Three DNS records exist to fix that: SPF lists which servers may send for you, DKIM signs your outgoing mail, and DMARC tells receiving servers what to do when something fails those checks. Without DMARC set to quarantine or reject, a forged message is usually delivered.
Is my domain really unprotected, or is this a scare tactic?
Check the DMARC line in your result. If it says no record, or a policy of p=none, then forged mail claiming to be you is not being blocked, and that is a fact about your DNS rather than an opinion. The raw record is shown underneath so you can verify it with any DNS lookup tool.
Why does p=none not protect me?
Because it means monitor only. The receiving server checks the message, notices it is forged, and delivers it anyway, because that is what your policy instructs. It is the standard starting point when DMARC is set up, and many domains are left there and never moved on to quarantine or reject.
How is the grade decided?
By your DMARC policy. No record is an F, p=none is a D, quarantine is a C and reject is a B. A reject policy is an A only when SPF is also set to hard fail and a DKIM key was found. A domain that does not resolve, or has nothing running on it, is not graded at all.
You said no DKIM key was found. Do I definitely not have one?
No, and the result says so. DKIM keys live at a name chosen by your email provider, called a selector, and there is no way to list them. We try 15 common ones (google, selector1, selector2, k1, k2, dkim, mail, s1, s2, default, mandrill, zoho, fd, pm and mailjet). Finding nothing means we could not guess yours, not that you have none. Your email provider can tell you in a minute.
Does this tell me if someone is spoofing me right now?
No. It shows whether they could, not whether they have. To see real attempts, add a reporting address (rua) to your DMARC record and read the aggregate reports receiving servers send back.
Your data
What do you store when I check a domain?
The domain, its grade and the time it was checked, but only when the domain receives mail. That record is what gives the result its own page and its place in our sitemap. The record holds nothing about who checked it, and nothing is sent to anyone. If you choose “Tell me if this changes”, we also keep your email address, described below.
Why does my result have a public page?
So you can send it to whoever manages your DNS instead of describing it to them. The page shows public DNS data, so it reveals nothing that a lookup would not. Pages for domains that do not resolve or do not receive mail are marked noindex, and only mail-receiving domains are listed in our sitemap.
What is “Tell me if this changes”?
An optional watch on one domain. You give an email address and we send a confirmation link; nothing happens until you click it. After that you get one email if the SPF, DKIM or DMARC records change or break. We keep the address and the domain until you unsubscribe, and each email carries an unsubscribe link.
Does the example forged email actually get sent?
No. It is a mockup drawn in your browser to show what a forged message would look like in a customer's inbox. Nothing is transmitted, and nothing on the page teaches anyone how to send one.
Mailient
Is this what Mailient does?
It is the other direction. This checks what leaves your name. Mailient handles what arrives in it: it reads the inbox, decides the few things that need you and drafts the replies.
More free tools
Try another one
WritingTwelve seconds a round
Spot the default
Two replies to the same email, both written by AI. One had a voice profile and one had none. You have twelve seconds to say which.
WritingInstant, then a few seconds
Writing voice analyserWhat does your email writing say about you?
Paste two emails you have sent. Get your writing fingerprint, measured from the text rather than guessed, and one new email in your voice.
This is what leaves your name. Mailient handles what arrives.
Spoofing is one direction of the problem. The other is the inbox itself: reading what came in, deciding the few things that need you, drafting the replies. That is the part Mailient does, on your existing Gmail.