Skip to content

Email spoofing check

If a domain publishes no DMARC policy, or publishes p=none, anyone can send mail that looks like it came from that domain. This checker answers that question first: given the live policy, can someone spoof you? Then it shows the rest of the stack so you can see what else is missing.

Public results are listed under "Last assessed domains". What we store

Public assessments are free. No account. The full 0 to 100 stack is included below the focused result.

Assessments are free and always will be. SecLens.ONE is funded by its operator, 42Sec PTE. LTD. There is no paid tier, no API product and no monitoring service today. Ticking "Keep this assessment private" keeps a spoofing check out of the public listing.

69.1%
of mail-enabled Top-1M domains are spoofable
30.8%
enforce quarantine or reject

Figures from the October 2026 Top-1M study.

The same assessment, protocol by protocol

Every checker below runs the full SecLens.ONE assessment and leads with its own result. The scoring weights are on the methodology page.

DMARC checker

DMARC tells receiving mail servers what to do with messages that fail SPF or DKIM for your domain.
SPF checker

SPF lists which hosts may send mail as your domain.
DKIM checker

DKIM signs outbound mail so receivers can prove a party that controls your domain sent the message.
MTA-STS checker

MTA-STS tells sending servers to use TLS to your MX hosts and to refuse a downgrade.
DANE checker

DANE binds MX certificates to DNS with TLSA records, but only if DNSSEC is actually validating.
TLS-RPT checker

TLS-RPT is how sending servers tell you that STARTTLS failed on the way to your MX.
Email security score

SecLens.ONE scores a domain from 0 to 100 across seven email-security protocols, using the same live DNS checks as the rest of the product.

Common questions

Can someone spoof my domain?

In practice, yes if there is no DMARC record or the policy is p=none. Receivers then have no instruction to refuse forged From: mail. p=quarantine and p=reject are the policies that change that, with reject the one that actually blocks.

Is SPF enough to stop spoofing?

No. SPF authorizes sending hosts, but it does not bind the visible From: header by itself, and it breaks on forwarding. DMARC is the policy that ties SPF and DKIM to the domain users see and tells receivers what to do on failure.

What does SecLens.ONE treat as spoofable?

The same definition as the Top-1M study: mail-enabled domains with no DMARC record or an explicit p=none. In the October 2026 corpus that was 69.1%, down from 70.9% in July. The two scans are different Radar snapshots, not the same domains measured twice. Most of the 1.8 point drop is one parked-domain portfolio that enforces and was not in the July top set. This page leads with that verdict, then still shows the full 0-100 stack.

Scoring rules are on the methodology page. The homepage still has the full product, including the live Pulse.