Can anyone send email as my domain? Check your SPF and DMARC records

Yes, anyone can, because the "from" line on an email is just text the sender typed. With SPF, DKIM and DMARC in your DNS, and DMARC set to quarantine or reject, a fake message from your domain ends up in spam or bounces.

What is email spoofing and why does it matter?

Email was designed long before anyone worried about fakes, and nothing in the original design checks the "from" line. That's how someone can send your customers an invoice that looks like it came from you.

Your domain can publish three short notes in its DNS, the public address book for your domain, and mail servers read them before they trust a message.

Some list too many services in SPF and break the limit on lookups, so the record stops working. If that sounds like your setup, look at the broken SPF records check.

A domain that never sends email is not safe by default either. Mail servers judge the domain in the "from" line, not whether it has a mailbox, so a quiet domain with no rules is an easy one to fake, and you never see the bounces.

How do I check?

A scan reads these records the same way a mail server does, so it can tell you exactly which one is missing or weak.

The quick outside look covers the homepage and the files it loads, email sender settings (SPF and DMARC), security headers and TLS, and public DNS, certificate and subdomain records, in at most 10 requests. Reading DNS records, certificate logs and domain registration never touches your site. The full details are in how we check.

If you'd rather look by hand, these read-only commands show the TXT records, the DMARC record and the mail server record for Atlas, our example app. Swap in your own domain.

dig +short TXT atlas.example
dig +short TXT _dmarc.atlas.example
dig +short MX atlas.example

If the DMARC lookup comes back empty, treat DMARC as missing and fix it first. Then compare what you see with the table above.

Check your site

How do I fix it?

Lockpick never changes anything on your site, your DNS or your accounts, so you add these records yourself at your DNS provider.

1. Write down every service that sends email as your domain. Think email provider, newsletter tool, and any app that sends receipts or sign-in emails for you.
2. Publish one SPF record that lists only those services. Keep the list short. If you list too many services in SPF, you break the limit on lookups and the record stops working.
3. Turn on DKIM signing inside each service that sends for you, and add the record each one gives you.
4. Publish a DMARC record with a reporting address you read. Read the reports until every real sender passes, then set the policy to quarantine or reject. Don't stop at "none".
5. Close your quiet domains too. A domain that never sends email needs three records to close it. They are a DMARC rule set to reject, an SPF record that allows no senders (v=spf1 -all), and an empty mail server record (0 .).
6. Check again once the records are live, and compare the new scan with the one before.

Each thing to fix about email comes with the record to add and a prompt for your AI. If you want your coding assistant to write the records, paste this.

Help me stop other people sending email as my domain. Do not change any code in this project.
Ask me for my domain and for every service that sends email for it, such as my email provider, my newsletter tool and any app that sends receipts or sign-in emails.
Write one SPF TXT record that lists only those services. Keep it within the SPF lookup limit and tell me how many lookups it uses.
Tell me where to turn on DKIM signing in each of those services.
Write a DMARC TXT record with a reporting address I control, and tell me when to move the policy to quarantine or reject.
If I tell you the domain never sends email, instead write a DMARC rule set to reject, an SPF record that allows no senders, and an empty mail server record.
Give me the exact host, type and value for each record so I can paste them into my DNS provider.

For more on giving fixes to your builder, see fix it with your AI.

What a check cannot tell you

Every check reads what your site already shows the public, plus public records about your domain, and nothing else. Don't read a passing SPF and DMARC result as proof that nobody has ever sent fake mail as your domain. Don't read a missing DMARC record as proof that someone has, either. Treat it as a gap to close.

Check the SPF list against the services you really send through. You know that list better than any outside reader of your DNS.

A Lockpick report is not a certificate and not a full penetration test. It covers what that scan could see on that day. Anything a scan couldn't check is marked as not checked, never as passed.