Mailient Research · Guide

How do you check if your domain can be spoofed?

Look up your domain's DMARC record. If there is none, or its policy is p=none, anyone can usually send email with your domain in the From: line and have it delivered. The steps below show how to read that record yourself, what SPF and DKIM add, and how to fix it. The free checker does the same lookups in seconds.

Updated 2026-09-25

Step by step

Read the DMARC record. It is a TXT record at _dmarc in front of your domain. From a terminal:
```
dig TXT _dmarc.yourdomain.com +short
```
On Windows, nslookup -type=TXT _dmarc.yourdomain.com returns the same record. No answer means there is no DMARC record.
Find the policy. Look for the p= tag in the record, such as v=DMARC1; p=none; rua=mailto:…. No record or p=none: a forged From: line is usually delivered. p=quarantine: it usually goes to spam. p=reject: receiving servers are asked to refuse it.
Read the SPF record. It is a TXT record at the domain itself that starts with v=spf1:
```
dig TXT yourdomain.com +short
```
Look at how it ends. -all tells receivers to fail mail from servers not listed; ~all only marks it as suspicious; ?all says nothing either way.
Look for a DKIM key. DKIM keys sit at selector._domainkey.yourdomain.com, where the selector is chosen by your email provider (for Google Workspace it is often google):
```
dig TXT google._domainkey.yourdomain.com +short
```
There is no way to list selectors, so ask your provider which one it uses if nothing answers.
Put it together. DMARC decides the outcome. SPF and DKIM are the checks it relies on, so a strong SPF record does not protect the From: line on its own. If the policy is missing or p=none, the domain can be spoofed.
Fix it in a safe order. Publish DMARC at p=none with a reporting address (rua=), confirm from the reports that your own mail passes, then move to p=quarantine and finally p=reject.
Or let the checker do all of it. The email spoofing checker reads the same records, tries 15 common DKIM selectors, shows the raw record behind every finding and gives you the exact DNS entries to add. Free, no account, and no email is sent.

How many domains fail this check?

When we ran the DMARC part of this check on the top 50,000 domains on 5 September 2026, 47.9% of the 36,548 that receive email had no record or p=none. What each policy means is explained in what a missing or p=none DMARC record means; the method and limits are in the paper.

Read the Q3 2026 paper · per-domain results (CSV) · check a domain

Questions

Can I check a domain I do not own?

Yes. SPF, DKIM and DMARC are published in public DNS so that any receiving mail server can read them, which means anyone can look them up. The steps on this page and the email spoofing checker both work on any domain.

If no DKIM key is found, does the domain have no DKIM?

Not necessarily. A DKIM key sits at a name chosen by the email provider, called a selector, and there is no way to list a domain's selectors. The checker tries 15 common ones. If none answers, the key may simply be at a selector it did not guess; the domain's email provider can tell you which one it uses.

Does checking send an email or alert the domain owner?

No. Every step is a DNS lookup of records the domain publishes for anyone to read. No email is sent, and nothing about the lookup reaches the domain owner.

How long do DNS changes take to show up?

Anywhere from a few minutes to a few hours, depending on the record's time-to-live. The checker also caches each domain's result for up to a day, so a fix you have just published may not appear there straight away.

Who published this

Mailient publishes this guide, the research behind it and the free checker. Mailient is an AI inbox assistant for founders. It connects to Gmail, shows what needs a decision today, can draft replies in your writing voice — including a daily morning sweep on paid plans — and by default will not send anything until you approve it.

What Mailient does, and does not do