Enter a domain to see whether it can be spoofed. We check the PUBLIC mail-authentication records every mail server already reads — SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI — and grade them A through F.
Most companies still run DMARC at p=none or publish nothing at all, and Google and Yahoo have required SPF, DKIM and a DMARC record from every bulk sender since February 2024. If your grade is a C or below, mail claiming to be from your domain can likely reach an inbox unauthenticated.
p=none does nothing but report, p=quarantine sends failures to spam, p=reject refuses them outright. Enforcement (quarantine or reject) is what actually stops spoofing — a record that only reports leaves every recipient exposed.This tool checks whether your domain CAN be spoofed. It does not watch for when it changes. CMDash’s DNS posture module re-checks every verified domain continuously, alerts on regression, and attaches the evidence to your compliance controls — included from the Essentials plan up.
Essentials and above re-scan every domain you verify, alert the moment SPF/DKIM/DMARC regresses, and keep the evidence for your next audit.