Skip to content
Clinic open · free diagnosis, no appointment needed2,000+ domains monitored

Can somebody send email as you?

One question, answered from your live DNS. The verdict follows the policy receivers actually apply, not the one your record claims.

Judged against RFC 9989 for policy, RFC 7208 for SPF

One question, answered from your live DNS. Free, and no signup.

Symptoms

A supplier pays an invoice they never received from you. A customer forwards a phishing message with your logo on it and asks whether it is genuine. Your own staff receive urgent requests from an executive who did not send them. In every case the mail is technically from you as far as the recipient can tell, and nothing in your systems has been breached.

Diagnosis

Email has two sender addresses. The envelope sender, which SPF checks and nobody sees, and the From header, which is what the recipient reads. Anyone can write anything in the second one.

DMARC is the only mechanism that connects them. It tells receivers to check that the From domain matches an authenticated identity, and what to do when it does not. That instruction is your policy, and there are exactly three answers:

  • p=none, report it and deliver anyway. You are spoofable.
  • p=quarantine, deliver to spam. Recipients can still find and open it.
  • p=reject, refuse it. This is protection.

Two things override that answer, and both are easy to miss. t=y makes receivers apply p=none whatever the policy says. And a policy inherited from a parent domain governs you through its sp value, not its p.

Cure

  1. Publish DMARC at p=none with a reporting address, and read the reports for a few weeks. This changes nothing about delivery and shows you who sends as you.
  2. Fix the legitimate senders the reports reveal. Every one should pass SPF or DKIM with alignment.
  3. Move to quarantine, then reject, and set sp to match so subdomains are not the soft target.
  4. Remove t=y when the rollout is done. Leaving it is the same as never having started.

Questions people actually ask

Can someone really send email as my domain?

Unless you publish an enforcing DMARC policy, yes, trivially, and without touching your systems. The From address a recipient sees is just text in the message; nothing verifies it by default.

I have SPF. Am I protected?

No. SPF authenticates the envelope sender, which recipients never see. A forger can pass SPF for their own domain while putting yours in the From header. DMARC is what ties the two together.

My DMARC says p=reject. Why does this still say I am spoofable?

Check for t=y in the record. Test mode tells receivers to apply p=none regardless of your policy, and it is the most common reason a domain that looks protected is not. This test reports the policy receivers actually apply.

What about my subdomains?

They follow sp, not p. A domain at p=reject with sp=none is still spoofable through invoices.yourdomain.com, and that reads just as convincingly in an inbox.

Related tests

Every fix on this site is yours to implement. If you would rather someone did it, I take this work directly.