Key points at a glance
- Without protection, an email’s sender can be forged as easily as the sender on an envelope.
- SPF, DKIM and DMARC with p=reject make sure forgeries of your domain are rejected.
- Against similar domains and forged display names, only a careful look at the sender address helps.
What is email spoofing?
The email protocol dates from a time when everyone knew everyone. So it doesn’t check by itself whether a sender is genuine. Whoever sends an email can enter any address as the sender. Only the SPF, DKIM and DMARC records in your domain’s DNS make a check possible.
The most common forms
- Forged domain: the email carries exactly your address, for example info@example.com. DMARC with p=reject stops this.
- Forged display name: it shows “Your boss”, but a different address is behind it. DMARC doesn’t help here.
- Similar domain: an almost identical address with swapped letters or a different ending. DMARC doesn’t help here either.
Free domain check
Is your company address protected?
Enter your domain or your email address. You see the result right here, with a traffic light and a grade from A to F.
You opened a link to a result. The check only starts when you click, always with the current state.
Privacy: if you enter an email address, we transmit only the domain; the part before the @ never leaves your browser. We use the domain only for this check of public DNS records and do not store it in plain text; we do not store the result. We store your IP address only as a checksum and for at most one day to curb abuse.
The quick check is based on public DNS data at the time of the query and does not replace a full review; no warranty.
Keep an eye on it continuously instead of checking once:
Book a free initial callMonitor your domain – 14 days freePrefer some help? Ask us to set it up- No commitment
- No credit card
- Ends on its own after 14 days
No-obligation request by email · price on request
What happens next
- Your email program opens a prepared request with your domain. Add your name and send it.
- We get back to you and discuss with you or your IT partner which records (SPF, DKIM, DMARC) are needed and what the setup costs.
- The setup needs access to the DNS management of your domain. We agree the handover with you – please never send us passwords by email.
- If you wish, DomainRadar then monitors your domain continuously and alerts you when something changes.
No email program opens? Write to us with your domain at info@domainradar.ch.
Good to know: this protection stops anyone forging exactly your domain. Against look-alike addresses, always confirm payment changes by phone.
All checks
Quick check based on public DNS records. Continuous monitoring also checks certificates, blocklists and your DMARC reports.
Your result as a PDF
As a report to keep or to forward to your IT.
Free and without an account: you confirm your address by email and can unsubscribe at any time.
How to recognise forged senders
Check the whole sender address, not just the name. Be careful if the reply address differs from the sender, if you’re pressured, or if new account details are given. In the email’s headers, the “Authentication-Results” line shows whether SPF, DKIM and DMARC passed or failed (fail).
- Look at the addressRead the full sender address, not just the name.
- Compare the reply addressIf it differs from the sender, be careful.
- If in doubt, callCall back on the number you know, never the one in the email.
When in doubt, ask
Call the sender on a number you already know. Don’t reply directly to the suspicious email.
How to stop your domain being forged
Three DNS records work together: SPF names the servers allowed to send for your domain. DKIM digitally signs every email. DMARC sets out what recipients should do with emails that fail both. Only with p=reject are forgeries rejected; before that, you collect reports with p=none, so no genuine email gets lost.
Protect domains without email too
Domains that send no email are especially popular targets for forgery. A DMARC record with p=reject and an SPF record with no allowed servers protect them too.
Frequently asked questions
Is email spoofing a criminal offence?
Anyone who defrauds people or obtains data using forged senders is committing an offence. If you suffer damage, file a report with the police.
Can I see if someone is forging my domain?
Yes, through the DMARC reports. The large mail providers report in them which servers sent email with your domain – including forged ones.
Is an SPF record enough?
No. SPF only checks the invisible sender address, not the sender shown in the mailbox. Only DMARC links the two and sets out what happens with forgeries.
How DomainRadar helps
DomainRadar checks SPF, DKIM and DMARC for your domains, evaluates the DMARC reports, and shows who sends email in your name. If a new, forged sender turns up, you get an alert – and you can see when the switch to p=reject is safe.
The domain check stays free. Afterwards you test DomainRadar with all features for 14 days – no credit card, the trial ends on its own.