Skip to content
All Articles
Email Security

How to Test If Your Domain Can Be Spoofed (And Fix It If It Can)

Most domains can be spoofed in phishing attacks. Learn how to test your spoofing vulnerability, interpret the results, and fix gaps in your email authentication.

5 min read

How to test your domain for spoofing

Testing spoofing vulnerability is straightforward. An email spoofing test checks your SPF, DKIM, and DMARC configuration and determines how protected you are against common spoofing techniques.

Use IsMyEmailBlacklisted's free email spoofing test: enter your domain and get an instant risk assessment with specific vulnerabilities identified.

What the test checks: - SPF: Is it published? Does it include all your sending servers? Does it end with -all or ~all? - DKIM: Are you signing outgoing emails? - DMARC: Is there a policy? Is it quarantine or reject? Does DMARC alignment work correctly?

Email spoofing test methods and risk levels

Test MethodWhat It ChecksRisk Level if FailsHow to Fix
SPF lookup checkSPF record exists, syntax valid, sending IPs authorizedHigh — unauthorized servers can send as your domainPublish or fix SPF TXT record
DKIM verificationDKIM key in DNS, emails are signed, signature validHigh — no proof of message integrity or sender identityEnable DKIM in your ESP, add public key to DNS
DMARC policy checkDMARC record exists, policy level (none/quarantine/reject)Critical if p=none — spoofed emails still deliveredUpgrade to p=quarantine, then p=reject
DMARC alignment testFrom: domain aligns with SPF envelope or DKIM d= domainHigh — attackers bypass SPF/DKIM via subdomain spoofingEnsure MAIL FROM domain matches From: domain
Subdomain spoofing testSubdomains have DMARC coverage (sp= tag or own policy)Medium — attackers may use sub.yourdomain.comAdd sp=reject to parent DMARC or publish subdomain DMARC
Lookalike domain testTyposquat/homograph domains that could impersonate youMedium — external threat, not DNS misconfigurationRegister key typosquats, monitor with brand protection tools
  • ·SPF record published and ends with -all (hard fail) not ~all (soft fail)
  • ·DKIM signing enabled for all services that send email from your domain
  • ·DMARC record published at _dmarc.yourdomain.com
  • ·DMARC policy is p=quarantine or p=reject (not p=none)
  • ·DMARC alignment passes: From: domain aligns with SPF envelope sender or DKIM d= domain
  • ·Subdomain policy covered: sp= tag set on parent DMARC or subdomains have their own records
  • ·From: header does not use a free email provider (gmail.com, yahoo.com, etc.) for bulk sending

Understanding your risk level

Critical risk: No SPF, no DKIM, no DMARC. Anyone can send spoofed email from your domain and receiving servers will accept it with no warnings.

High risk: SPF or DKIM only, no DMARC. You have some authentication but no enforcement — spoofed emails still get delivered.

Medium risk: DMARC p=none. You have visibility into spoofing but zero enforcement. Spoofed emails still reach recipients.

Low risk: DMARC p=quarantine. Spoofed emails go to spam rather than inbox — still visible to attackers.

Safe: DMARC p=reject. Spoofed emails are blocked entirely. Maximum protection.

Fixing spoofing vulnerabilities

Missing SPF: Create and publish an SPF TXT record listing all authorized sending servers.

Missing DKIM: Enable DKIM signing in each email service you use. Add the public key to DNS.

Missing DMARC: Add a DMARC TXT record at _dmarc.yourdomain.com. Start with p=none and rua= reporting.

DMARC p=none: Progress to p=quarantine and then p=reject. Follow the gradual enforcement path — don't jump straight to p=reject.

SPF alignment failure: Ensure the domain in your MAIL FROM matches your From: domain (relaxed alignment) or is exactly your domain (strict alignment).

DKIM alignment failure: Ensure the d= domain in DKIM-Signature matches or is a subdomain of your From: header domain.

Check your domain's email health

Run a free scan against 60 blacklists. Validate SPF, DKIM, DMARC, and MX records in seconds.