Domain spoofing test
Can someone send email that looks like it came from your CEO? One grade, built from the records that decide it.
Public data, possible errors. Every result here is built only from publicly available information: DNS records, and what a server shows to anyone who connects. It can be incomplete or wrong. DNS caching, a record changed minutes ago, split-horizon DNS, or a provider that signs and routes mail on your behalf can all make the public view differ from your real configuration. Treat a result as a starting point, not a verdict, and always have an administrator with the appropriate privileged access confirm it on the systems themselves before changing anything.
How the grade works
The grade answers one question: if an attacker sends mail with your domain in the From: address, what happens to it? DMARC decides that, so it sets the ceiling: p=reject can reach A, p=quarantine B, p=none is a D, and no DMARC at all is an F.
Each gap in how far an enforced policy reaches costs one grade: a policy that covers only part of the mail (pct below 100), or subdomains left open (sp=none). An SPF record ending in +all is an F on its own, because it lets anyone's mail pass SPF in your name, and DMARC with it.
The grade is about forged mail, not about whether your own mail is delivered. Issues that only affect your legitimate mail, like a missing SPF record or a short DKIM key, are listed separately under Also worth fixing.
Records fixed? Now test the people.
SPF, DKIM and DMARC stop someone forging your domain. They don't stop a lookalike domain, or a colleague typing their password into one. Phishtime runs authorised phishing simulations against your own team, free for up to 25 employees.