> Find out in plain English whether someone could send email pretending to be your domain, from its SPF and DMARC policy. Free, no sign-up.

Source: https://vaartix.com/tools/spoofing-check

[Free email tools](https://vaartix.com/tools) · [SPF, DKIM and DMARC checker](https://vaartix.com/tools/email-auth-checker)

# Can anyone spoof my domain?

Free · No sign-up · Nothing stored

Enter your domain to find out whether someone else could send email that looks like it's from you, and what to change if they could.

## Questions

**How does someone spoof a domain?**

Email lets any server put any address in the From line. Receiving servers only reject a forged From when the domain publishes a DMARC policy telling them to. Without one, much spoofed email is delivered.

**What should my DMARC policy be?**

Start with `p=none` and a `rua=` address to get reports. Once the reports show all your real email passing, move to `p=quarantine` and then `p=reject`. See [how to tighten DMARC safely](https://vaartix.com/docs/guides/spf-dkim-dmarc/#tighten-dmarc-safely).

**What are pct and sp?**

`pct` is the share of failing email the policy applies to (100 if not set). `sp` is the policy for subdomains; if it's `none`, anyone can spoof `anything.yourdomain` even with `p=reject`.

**Do you store the domains I check?**

No. The check reads public DNS and the result is shown to you only. We keep an anonymous count of how many checks are run each day, nothing else. Checks are limited to 10 a minute per visitor.

**Send with Vaartix.** A transactional email API built in India: SPF, DKIM and a return path on your domain are set up for you, and every feature is free during the private beta.

[Send with Vaartix](https://vaartix.com/#early-access)