Can anyone send email that looks like it came from your domain?

The email spoofing check reads whether a domain that receives email has a DMARC policy telling mail servers to quarantine or reject fakes. Without one, nothing on your side stops a message that claims to be you.

What does this check look at?

It looks at whether a domain that receives email has a DMARC policy telling mail servers to quarantine or reject fakes. DMARC tells mail servers what to do with a message that fails those checks, for example put it in spam or reject it, and where to send reports. It reads your public DNS records the way a mail server does.

Most domains have SPF but no DMARC, or DMARC set to none, which only watches and never blocks.

Pulse and Deep scans both run it. It reads public records about your domain and never touches your site.

What does a result mean?

Nothing is sent, so it does not show that a fake message would reach an inbox. A clean result means nothing was found in what the scan read. It does not prove the problem is absent from parts the scan never sees.

How serious is a finding?

Fix this soon. A finding of this kind needs a victim or a second step before it causes harm, so it ranks below anything someone could use directly. Confidence starts at medium, because it rests on public records rather than a response from your site. The report lists what to fix by how directly someone could use it, not by the severity label. Cloudflare explains that the DMARC policy decides whether a failing email is marked as spam, blocked or delivered.

What does a confirmed finding have to show?

Which standards does it relate to?

Each one is a related control, not a verification. A scan sees what anyone online can see, so it never proves a whole requirement is met.

Fix it with your AI

Moving straight to reject can bounce your own mail, so this prompt goes in stages.

Help me stop fake email from my domain in safe stages. First make sure my SPF record and DKIM signing cover every service that sends mail as my domain. Then publish a DMARC record at _dmarc with p=none and a rua= reporting address. Tell me what to look for in the reports over the next two weeks, and give me the exact record to switch to p=quarantine and later p=reject once only my real senders appear.

How to check

Say Atlas, our example app at atlas.example, receives mail and publishes DMARC with p=none. The check flags it, because a message that fails SPF and DKIM is still delivered.

The free quick check covers this on your homepage with no account, and a Pulse scan from your account adds your scripts and public records. Pulse or Deep explains the difference.