Key points at a glance
- First find out: was your account hacked, or has someone only spoofed your sender address?
- Secure a hacked account with a new password and two-factor authentication; stop a spoofed sender with DMARC.
- DMARC only protects your own exact domain, not look-alike addresses.
First, find out: spoofed or hacked?
From the outside, both cases look the same: someone receives an email that claims to be from you. But behind that are three quite different situations.
- Spoofed sender: the email doesn’t come from your mailbox. Fraudsters simply enter your address as the sender. You’ll find nothing about it in your “Sent” folder.
- Hijacked mailbox: someone knows your password and writes directly from your mailbox. You’ll often find the emails in the “Sent” folder, or new rules that forward or delete emails.
- Look-alike address: the sender only looks similar, for example with a swapped letter in the domain, or your name shown in front of a free Gmail or Outlook address.
- CheckLook at the “Sent” folder and the rules in your mailbox.
- Secure your accountNew password and two-factor authentication.
- Warn your contactsInform those affected through a channel you know is genuine.
- Protect your domainSet up SPF, DKIM and DMARC.
Bounces as a clue
Suddenly getting lots of non-delivery notices for emails you never sent? That’s a sign someone is misusing your address as the sender.
If your account has been hacked
Then someone has access to your mailbox and can read along. Act immediately:
- Change your password, and do it on a device you trust.
- Turn on two-factor authentication: besides the password, this then requires a code from an app.
- Check the rules in your mailbox and remove unknown external forwarding rules as well as rules that delete or move emails.
- Inform your IT team or email provider so that all signed-in devices are also logged out.
Free domain check
Is your company address protected?
Enter your domain or your email address. You see the result right here, with a traffic light and a grade from A to F.
You opened a link to a result. The check only starts when you click, always with the current state.
Privacy: if you enter an email address, we transmit only the domain; the part before the @ never leaves your browser. We use the domain only for this check of public DNS records and do not store it in plain text; we do not store the result. We store your IP address only as a checksum and for at most one day to curb abuse.
The quick check is based on public DNS data at the time of the query and does not replace a full review; no warranty.
Keep an eye on it continuously instead of checking once:
Book a free initial callMonitor your domain – 14 days freePrefer some help? Ask us to set it up- No commitment
- No credit card
- Ends on its own after 14 days
No-obligation request by email · price on request
What happens next
- Your email program opens a prepared request with your domain. Add your name and send it.
- We get back to you and discuss with you or your IT partner which records (SPF, DKIM, DMARC) are needed and what the setup costs.
- The setup needs access to the DNS management of your domain. We agree the handover with you – please never send us passwords by email.
- If you wish, DomainRadar then monitors your domain continuously and alerts you when something changes.
No email program opens? Write to us with your domain at info@domainradar.ch.
Good to know: this protection stops anyone forging exactly your domain. Against look-alike addresses, always confirm payment changes by phone.
All checks
Quick check based on public DNS records. Continuous monitoring also checks certificates, blocklists and your DMARC reports.
Your result as a PDF
As a report to keep or to forward to your IT.
Free and without an account: you confirm your address by email and can unsubscribe at any time.
If only the sender has been spoofed
Here your mailbox isn’t affected. Fraudsters exploit the fact that email originally didn’t check the sender at all – like a letter, where anyone can write any sender they like.
What helps here is a DNS record for your domain called DMARC, together with SPF and DKIM. These tell recipients which servers are allowed to send for your domain, and what should happen to all other emails. Only the strictest level, p=reject, makes recipients reject forgeries.
Where DMARC doesn’t help
DMARC only prevents someone from spoofing exactly your domain as the sender. It doesn’t help against look-alike domains, free addresses using your name, or calls with an imitated voice. For that you need alert staff and clear processes.
Warning customers and suppliers
Inform affected contacts, ideally by phone or through a channel you know is genuine, not by replying to the suspicious email. Ask them not to make any payment to a new account without checking with you briefly first.
If damage has occurred, for example through a payment to fraudsters, file a report with the police. You can also report incidents to the Swiss Federal Office for Cybersecurity (FOCS).
Four-eyes principle for payments
Always have new or changed account details confirmed by a second person through a channel you know is genuine. This also protects against tricks that no technology can stop.
Frequently asked questions
Can I stop someone from spoofing my sender address?
For your own domain, yes: with SPF, DKIM and DMARC at the p=reject level, the major email providers reject forgeries. It doesn’t help against look-alike domains or free addresses using your name, though.
How can I tell if my account has been hacked?
Typical signs are emails in the “Sent” folder that you didn’t write, unknown forwarding or deletion rules, and sign-ins from unfamiliar locations. If you find none of that, only the sender was probably spoofed.
Do I have to report the incident?
Reporting to the Swiss Federal Office for Cybersecurity (FOCS) is voluntary and helps warn others. In the event of financial damage, file a report with the police. If an account was hacked and personal data is affected, additional reporting obligations under data protection law may also apply.
How DomainRadar helps
DomainRadar uses your DMARC reports to show who is sending emails in your name, guides you step by step to the p=reject level, and alerts you by email when something changes in your records. The free check shows whether your domain is already protected against spoofed senders today.
The domain check stays free. Afterwards you test DomainRadar with all features for 14 days – no credit card, the trial ends on its own.