How to Test If Your Domain Can Be Spoofed (And Fix It If It Can)
Most domains can be spoofed in phishing attacks. Learn how to test your spoofing vulnerability, interpret the results, and fix gaps in your email authentication.
How to test your domain for spoofing
Testing spoofing vulnerability is straightforward. An email spoofing test checks your SPF, DKIM, and DMARC configuration and determines how protected you are against common spoofing techniques.
Use IsMyEmailBlacklisted's free email spoofing test: enter your domain and get an instant risk assessment with specific vulnerabilities identified.
What the test checks: - SPF: Is it published? Does it include all your sending servers? Does it end with -all or ~all? - DKIM: Are you signing outgoing emails? - DMARC: Is there a policy? Is it quarantine or reject? Does DMARC alignment work correctly?
Email spoofing test methods and risk levels
| Test Method ↕ | What It Checks ↕ | Risk Level if Fails ↕ | How to Fix ↕ |
|---|---|---|---|
| SPF lookup check | SPF record exists, syntax valid, sending IPs authorized | High — unauthorized servers can send as your domain | Publish or fix SPF TXT record |
| DKIM verification | DKIM key in DNS, emails are signed, signature valid | High — no proof of message integrity or sender identity | Enable DKIM in your ESP, add public key to DNS |
| DMARC policy check | DMARC record exists, policy level (none/quarantine/reject) | Critical if p=none — spoofed emails still delivered | Upgrade to p=quarantine, then p=reject |
| DMARC alignment test | From: domain aligns with SPF envelope or DKIM d= domain | High — attackers bypass SPF/DKIM via subdomain spoofing | Ensure MAIL FROM domain matches From: domain |
| Subdomain spoofing test | Subdomains have DMARC coverage (sp= tag or own policy) | Medium — attackers may use sub.yourdomain.com | Add sp=reject to parent DMARC or publish subdomain DMARC |
| Lookalike domain test | Typosquat/homograph domains that could impersonate you | Medium — external threat, not DNS misconfiguration | Register key typosquats, monitor with brand protection tools |
- ·SPF record published and ends with -all (hard fail) not ~all (soft fail)
- ·DKIM signing enabled for all services that send email from your domain
- ·DMARC record published at _dmarc.yourdomain.com
- ·DMARC policy is p=quarantine or p=reject (not p=none)
- ·DMARC alignment passes: From: domain aligns with SPF envelope sender or DKIM d= domain
- ·Subdomain policy covered: sp= tag set on parent DMARC or subdomains have their own records
- ·From: header does not use a free email provider (gmail.com, yahoo.com, etc.) for bulk sending
Understanding your risk level
Critical risk: No SPF, no DKIM, no DMARC. Anyone can send spoofed email from your domain and receiving servers will accept it with no warnings.
High risk: SPF or DKIM only, no DMARC. You have some authentication but no enforcement — spoofed emails still get delivered.
Medium risk: DMARC p=none. You have visibility into spoofing but zero enforcement. Spoofed emails still reach recipients.
Low risk: DMARC p=quarantine. Spoofed emails go to spam rather than inbox — still visible to attackers.
Safe: DMARC p=reject. Spoofed emails are blocked entirely. Maximum protection.
Fixing spoofing vulnerabilities
Missing SPF: Create and publish an SPF TXT record listing all authorized sending servers.
Missing DKIM: Enable DKIM signing in each email service you use. Add the public key to DNS.
Missing DMARC: Add a DMARC TXT record at _dmarc.yourdomain.com. Start with p=none and rua= reporting.
DMARC p=none: Progress to p=quarantine and then p=reject. Follow the gradual enforcement path — don't jump straight to p=reject.
SPF alignment failure: Ensure the domain in your MAIL FROM matches your From: domain (relaxed alignment) or is exactly your domain (strict alignment).
DKIM alignment failure: Ensure the d= domain in DKIM-Signature matches or is a subdomain of your From: header domain.
Check your domain's email health
Run a free scan against 60 blacklists. Validate SPF, DKIM, DMARC, and MX records in seconds.
Related free tools