Can email in your name be forged?

Email's "From" line is whatever the sender types. Three short records at your domain company decide whether Gmail and Outlook can tell your real email from a fake "our bank details changed" message in your name. Enter your domain (the part after the @ in your email address) to see where you stand.

The check runs in your browser using public DNS (Cloudflare's and Google's DNS-over-HTTPS). Nothing you type is stored or sent anywhere else.

What the three records do

• SPF lists the services allowed to send email as you (your email host, invoicing tool, website form).
• DKIM puts a signature on each email, which receivers can verify against a key at your domain.
• DMARC tells receivers what to do with mail that fails both: deliver it anyway (p=none), send it to spam (quarantine), or refuse it (reject). Without it, a forged email has nothing stopping it.

Since February 2024 Gmail and Yahoo require SPF or DKIM from every sender, so missing records also push your own real email toward the spam folder.

Want it fixed?

The records shown above are a correct starting point you can paste in yourself. If you would rather have it done, I add them at your domain company for a fixed $75, paid only after this page shows you protected. No password shared: most domain companies let you invite a helper and remove the access afterwards. Write to s.n.psaradellis@gmail.com with your domain. A worked example · all examples and who I am.