How do I test if my domain can be spoofed?

Enter the domain in an email spoofing test like this one. It reads the DMARC and SPF records from DNS and tells you whether forged mail would be refused, sent to spam or delivered.

Does DMARC p=none stop spoofing?

No. p=none only asks receivers to send reports. Forged mail is delivered as normal, so the domain can still be spoofed.

Does this test send an email?

No. It only reads public DNS records. Nothing is sent from or to the domain.

Is p=quarantine enough?

It sends forged mail to spam rather than refusing it, so it's much better than none but not complete. Move to p=reject once DMARC reports show your real senders pass.

Can subdomains be spoofed when the main domain has p=reject?

Only if the DMARC record sets sp=none. Without sp=, subdomains follow p=. The test reports sp=none as a gap.

Can I test many domains at once?

Yes. Paste up to 100 domains without an account, or 500 after a Google sign-in, and download the results as CSV.

Email spoofing test: can someone send email as your domain?

An email spoofing test answers whether someone can send mail as you@yourdomain today. It reads the domain's DMARC policy (p=, sp=, pct=) and SPF record from DNS: no DMARC or p=none means yes, it can be spoofed; p=quarantine means partly; p=reject means receivers that check DMARC refuse forged mail. Each gap is explained, with the fix.

Your domain, or a list of domains one per line (up to 100)

Upload a CSV or TXT fileDNS lookups only; no email is sent. 100 domains a run, or 500 when you sign in.

SimpleAPI

Sample result

Yes, acme.example can be spoofed: its DMARC record is at p=none, so forged mail is still delivered.

Domain: acme.example
DMARC: p=none (monitor only)
SPF: ~all

What this means for you

Move DMARC to quarantine, then reject, once your real senders pass. Each gap comes with its fix.

Next step:Build a DMARC record

Yes, partly or no, from DMARC p=, sp= and pct=
Flags SPF +all, which defeats DMARC
100 domains a run, 500 when signed in
The fix for every gap, and a CSV

Spoofing
DMARC
Bulk

By SimpleVerifier Team · Last updated October 20, 2026

How do I check if my domain can be spoofed?

Enter your domain, or paste a list of up to 100 domains, one per line (500 when signed in with Google).
Press Test spoofing. The DMARC record at _dmarc. (or the parent domain's, for a subdomain), the SPF record and the MX records are read from DNS.
Read the answer: can be spoofed, partly protected or protected, with the reason in plain English and the one change that would help most.
Open What we found for each record and its meaning, or download the CSV for a list.

Example

You enter: The domain acme.example, whose DMARC record is v=DMARC1; p=none; rua=mailto:dmarc@acme.example.
You get: Can be spoofed: DMARC at p=none only monitors, so forged mail as anyone@acme.example is still delivered. The fix says to check the reports, then move to p=quarantine and p=reject. A domain at p=reject with no sp=none comes back Protected.
Limits: Up to 100 domains a run without an account and 500 when signed in with Google. DNS lookups only; nothing is sent to the domain.

Can my domain be spoofed?

If it has no DMARC record, or its DMARC record is at p=none, yes. Anyone can put your domain in the From line of an email, and nothing tells the receiving server to stop it. DMARC is the record that does: it asks receivers to check that a message passes SPF or DKIM for your domain, and says what to do when it doesn't.

p=reject tells receivers to refuse forged mail, p=quarantine to put it in spam, and p=none only to report it. The test also reads sp=, which sets the policy for subdomains, and pct=, which applies the policy to only part of failing mail.

Isn't SPF enough to stop spoofing?

No. SPF checks the envelope sender (the Return-Path), which the forger chooses, not the From address the reader sees. A forger can pass SPF for their own domain while showing yours. Only DMARC ties the visible From address to SPF or DKIM.

One SPF mistake does matter: a record ending in +all authorises every server on the internet, so a forger passes SPF as your domain and DMARC with it. The test flags +all as spoofable whatever the DMARC policy.

How do I stop my domain being spoofed?

Publish a DMARC record with a rua= address for reports, starting at p=none. Read the reports for a few weeks to make sure every service that sends as you (your mailbox provider, your email platform, your CRM) passes SPF or DKIM, then move to p=quarantine and finally p=reject. Our post on moving DMARC from none to reject walks through it, and the DMARC generator builds the record.

A domain that never sends mail should say so: v=spf1 -all as its SPF record and v=DMARC1; p=reject as its DMARC record lock it down completely.

What this test can't see

It reads what the domain publishes. A receiver that ignores DMARC can still deliver forged mail, and a look-alike domain such as examp1e.com is a different domain with its own records; check those with the lookalike domain checker. Nothing is sent to the domain, so the test can't show whether your real mail passes; a delivered message's headers show that.

What do the DMARC policies do to forged mail?

Policy	Forged mail	Verdict here
No DMARC record	Delivered	Can be spoofed
`p=none`	Delivered, and reported	Can be spoofed
`p=quarantine`	Sent to spam	Partly protected
`p=reject`	Refused	Protected
Any policy with SPF `+all`	Can pass as you	Can be spoofed

Who uses this tool, and for what?

Business owners: Find out whether someone could send invoices or password resets that appear to come from your domain.
IT and security teams: Audit every domain the company owns, parked ones included, and see which still need a DMARC policy.
Agencies: Show a client in plain English why their domain needs DMARC before a campaign goes out.
Deliverability consultants: Get a first pass over a prospect's domains before a deeper DMARC report review.

What can’t this tool tell you?

It reads published records only. Whether a given receiver enforces DMARC is up to that receiver.
Look-alike domains are different domains and aren't covered.
The parent domain for a subdomain is found with a common-suffix rule, not the full Public Suffix List, so rare country suffixes can be misread.
Up to 100 domains a run without an account, 500 signed in.

Common questions

How do I test if my domain can be spoofed?: Enter the domain in an email spoofing test like this one. It reads the DMARC and SPF records from DNS and tells you whether forged mail would be refused, sent to spam or delivered.
Does DMARC p=none stop spoofing?: No. p=none only asks receivers to send reports. Forged mail is delivered as normal, so the domain can still be spoofed.
Does this test send an email?: No. It only reads public DNS records. Nothing is sent from or to the domain.
Is p=quarantine enough?: It sends forged mail to spam rather than refusing it, so it's much better than none but not complete. Move to p=reject once DMARC reports show your real senders pass.
Can subdomains be spoofed when the main domain has p=reject?: Only if the DMARC record sets sp=none. Without sp=, subdomains follow p=. The test reports sp=none as a gap.
Can I test many domains at once?: Yes. Paste up to 100 domains without an account, or 500 after a Google sign-in, and download the results as CSV.

Sources

Authentication and capacity are half of deliverability.

The other half is who you send to. Every hard bounce counts against the domain and inboxes you are sending from, and nothing in DNS can tell you which addresses on your list are dead.

Bulk verification with real SMTP mailbox checks
Hard bounces removed before a send, not discovered after
Catch-all, disposable and role detection on every row

Get started — $29.99/mo See the published limits first

One plan, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.