Email spoofing test: can someone fake your domain?

A customer gets an email from “you”. It carries your name, your domain, your logo, and a polite note saying your bank details have changed. You never sent it.

That is email spoofing, and the worry behind the search “email spoofing test” is simple: could someone do that to my business, and how would I know? This page shows how to find out in a few minutes, what the answer means, and what to ask if the answer is bad.

What email spoofing is, in plain English

Email was designed in a more trusting time. The “From” line on an email is just text the sender types in, like the return address on an envelope. Nothing in the basic system checks that it is true.

So anyone can write a message that says it is from you@yourbusiness.co.ke. Whether it reaches the inbox, lands in spam or is thrown away depends on what your domain has told the world to do with mail that is not really from you.

Microsoft lists spoofed senders as a common tool in business email compromise (fake invoices and payment requests) and in phishing. That is why the test matters for any business that sends invoices or takes payments by email.

Spoofing is not the same as your mailbox being hacked. In a hack, the attacker is inside your account. In spoofing, they never get in. They just pretend.

Why a business is open to it by default

Your domain can publish three kinds of public record that fight spoofing. They are usually called SPF, DKIM and DMARC. In short:

• SPF is a list of the servers allowed to send email for your domain.
• DKIM is a digital signature added to your outgoing mail, so receivers can see it was not changed on the way.
• DMARC ties the two together, says what receivers should do when a message fails, and asks them to send you reports.

Microsoft’s own documentation is blunt about why the first two are not enough alone. SPF checks a hidden sending address, not the “From” name a person actually reads, so an attacker can pass SPF using a domain of their own and still show your name. DMARC is the piece that connects the check to the address people see, and that sets the action to take on failures.

If you want these explained at more length, see SPF, DKIM and DMARC without the acronyms.

How common is the gap?

More common than most owners expect. One independent measurement of the million most popular websites, taken on 17 July 2026, looked at the 659,259 of them that receive email. For 67.4% of those, nothing in their DNS tells receiving servers to stop a forged message. Of the domains that did publish a DMARC record, only 46.9% had it set to actually act on failures. The author is a deliverability researcher, not a regulator, so treat the exact figures as one careful count, not a law of nature. The pattern is the point: having a record and having protection are different things.

How to run an email spoofing test

There are two parts. The first is safe and takes five minutes. The second is for your IT person or email provider.

Part 1: read what your domain says

1. Open the free domain security checker and type your domain, such as yourbusiness.co.ke. It reads public records only.
2. Wait for the result. It looks at DMARC, SPF, DKIM, DNSSEC, CAA, MX and MTA-STS, and takes about twenty seconds. There is no signup.
3. Look at the DMARC and SPF lines first. Those two decide most of your spoofing risk.
4. Write down anything marked as failing or as a warning. That list is what you take to your IT person.

What the DMARC line tells you:

• No DMARC record. Forged mail in your name is delivered as if it were genuine, unless the receiver’s own filters happen to catch it.
• A record that only watches. This is called a “none” policy. Your domain asks for reports and asks receivers to take no action. It is a good first step and a bad place to stay.
• Quarantine. Forged mail is sent to spam.
• Reject. Receivers are asked to refuse forged mail outright. This is the goal.

One honest limit: the checker can read what your domain publishes. It cannot see inside your email system. Also, DKIM cannot be reliably detected from the outside, so a “not found” for DKIM is not proof that it is missing. Our checker does not count it in the grade for that reason.

Part 2: ask for a real-world test

Reading records tells you what you have asked for. A live test shows what receivers do with it. Ask your IT person or email provider to send test messages that pretend to be your domain only to mailboxes you own, such as a personal Gmail and a Microsoft account, and to tell you where each one landed (inbox, spam or refused).

Do not test by emailing customers, staff or anyone who has not agreed. A forged message that reaches a real person is a phishing attempt, whatever your intentions were.

What “fixed” looks like

You do not need the technical detail to judge progress. You want to be able to say yes to these:

• Every service that sends email as you (your mailbox, your invoicing tool, your newsletter tool, your website forms) is known and accounted for.
• Your domain asks receivers to quarantine or reject forged mail, not just watch.
• Someone is receiving the DMARC reports and reading them.
• Nobody has to remember to update anything when you add a new tool, because there is a process.

The mistake that makes things worse

The risky move is jumping straight to the strictest setting. If you have not listed every legitimate sender first, your own invoices, receipts and newsletters can start being refused. The safe order is: find every sender, start in watch mode, read the reports, then tighten step by step. Our guide to stopping email spoofing sets out that sequence, and none, quarantine and reject explains what each setting does to your mail.

Even Google, which now asks bulk senders to authenticate with SPF, DKIM and DMARC, says the point of authentication is to help protect you from being impersonated, and to make your mail less likely to be rejected or marked as spam. It is a double benefit: fewer fakes, and your real mail arrives.

Questions to ask your IT person or host

• Does our domain have a DMARC record, and is it set to watch, quarantine or reject?
• Who receives the reports, and when did anyone last read them?
• Have we listed every service that sends email as us?
• Is there more than one SPF record, or too many lookups in it?
• Can you run a controlled spoofing test to our own mailboxes and show us the result?

If the answers are vague, that is the finding. A record with no owner tends to drift out of date.

Want us to check yours?

Start with the free domain security checker. It takes about twenty seconds and needs no signup.

If it shows a gap, or you would rather someone took responsibility for closing it safely, our domain and email security service finds every sender, puts the records in order in a sequence that keeps your real mail flowing, and tests the result with you.

• Email hello@wpfoss.com
• WhatsApp +254 118 271 160
• Tell us what you need

Sources and further reading

• Email authentication in cloud organizations, Microsoft Learn. Source for spoofed senders being used in business email compromise and phishing, SPF checking only the hidden sending address, and DMARC linking the check to the visible From address and setting the action on failure.
• RFC 7489: DMARC, IETF. Source for DMARC’s aim of reducing delivered spoofed email and for the “none” policy asking for no specific action.
• Email sender guidelines, Gmail Help, Google. Source for bulk senders needing SPF, DKIM and DMARC, and for authentication helping protect you from being impersonated.
• Two-thirds of the top million domains can still be spoofed, Artem Berezin, 21 July 2026. Source for the 17 July 2026 figures (659,259 mail-receiving domains, 67.4% without an enforced policy, 46.9% enforcement among DMARC publishers). One author’s measurement, not an official statistic.