Ujiajiri
Can someone send email pretending to be you?
Enter your domain. We read the public records that decide whether a stranger can email your customers using your business name — and tell you, in plain English, what to fix.
Free, no signup, nothing stored. We only read public DNS records — the same information any mail server on the internet can already see about your domain.
Three records decide whether your domain can be forged.
Together they prove a message really came from you — and tell the receiving server what to do when one doesn't.
Who may send as you
Lists the servers permitted to send using your domain. Two SPF records is invalid — receivers ignore both. It also has a hard limit of ten DNS lookups, and going over it switches SPF off entirely.
A signature that can't be forged
Signs every message so any alteration in transit is detectable. It is also what keeps your mail passing when someone forwards it — forwarding breaks SPF, and DKIM is the fallback. Usually lost during a change of provider.
The policy, and the reports
Tells receivers to refuse forgeries, and emails you a daily report of everyone sending in your name. This is the one that actually stops spoofing — SPF and DKIM only prove identity, DMARC is what acts on it.
We also read your MX records to see who handles your mail, so we can tell whether your provider's own DKIM key is missing. They only appear in the results if something is wrong with them.
Want the longer explanation? Read how email security works or DNS records every freelancer must know.