# Can anyone send email that looks like it came from your domain?

By Mark Kashef, founder of Lockpick. Published 2026-10-08, updated 2026-10-08.

The email spoofing check reads your DMARC policy to see whether mail servers are told to stop fake mail from your domain. Here is how to close the gap safely.

The email spoofing check reads whether a domain that receives email has a DMARC policy telling mail servers to quarantine or reject fakes. Without one, nothing on your side stops a message that claims to be you.

## What does this check look at?

It looks at whether a domain that receives email has a DMARC policy telling mail servers to quarantine or reject fakes. DMARC tells mail servers what to do with a message that fails those checks, for example put it in spam or reject it, and where to send reports. It reads your public DNS records the way a mail server does.

Most domains have SPF but no DMARC, or DMARC set to none, which only watches and never blocks.

Pulse and Deep scans both run it. It reads public records about your domain and never touches your site.

## What does a result mean?

| What the report shows | What it means | What to do |
| --- | --- | --- |
| No finding | DMARC quarantines or rejects failing mail. | Nothing. |
| Medium finding | The domain receives mail and DMARC is missing or only watches. | Add a report address, then move the policy to quarantine and later reject. |

Nothing is sent, so it does not show that a fake message would reach an inbox. A clean result means nothing was found in what the scan read. It does not prove the problem is absent from parts the scan never sees.

## How serious is a finding?

Fix this soon. A finding of this kind needs a victim or a second step before it causes harm, so it ranks below anything someone could use directly. Confidence starts at medium, because it rests on public records rather than a response from your site. The report lists what to fix by how directly someone could use it, not by the severity label. Cloudflare explains that the DMARC policy decides whether a failing email is marked as spam, blocked or delivered.

### What does a confirmed finding have to show?

| Part | For this check |
| --- | --- |
| Where it starts | Anyone on the internet sending mail |
| The protection that should stop it | DMARC does not quarantine or reject mail that fails checks |
| What is reached | Mail servers may deliver mail that claims your domain |
| What follows | Phishing or invoice fraud in your name, if people are fooled |

## Which standards does it relate to?

| Standard | Reference |
| --- | --- |
| OWASP Top Ten | `A02:2025` Security Misconfiguration |
| CWE | `CWE-345` |

Each one is a related control, not a verification. A scan sees what anyone online can see, so it never proves a whole requirement is met.

## Fix it with your AI

Moving straight to reject can bounce your own mail, so this prompt goes in stages.

:::fix-prompt any
Help me stop fake email from my domain in safe stages. First make sure my SPF record and DKIM signing cover every service that sends mail as my domain. Then publish a DMARC record at _dmarc with p=none and a rua= reporting address. Tell me what to look for in the reports over the next two weeks, and give me the exact record to switch to p=quarantine and later p=reject once only my real senders appear.
:::

## How to check

Say Atlas, our example app at `atlas.example`, receives mail and publishes DMARC with p=none. The check flags it, because a message that fails SPF and DKIM is still delivered.

The free [quick check](/check) covers this on your homepage with no account, and a Pulse scan from your account adds your scripts and public records. [Pulse or Deep](/docs/get-started/pulse-or-deep) explains the difference.

## Questions people ask

### My domain does not send email. Does this matter?

Yes. Mail servers judge the domain in the From line, not whether it has a mailbox. A quiet domain with no rules is an easy one to fake.

### Will p=reject stop my newsletter from arriving?

Only if your newsletter tool is not covered by SPF or DKIM. The reports from the p=none stage show that before you switch.

## Sources

- [Email anyone can send](https://www.lockpick.app/docs/learn/email-anyone-can-send), Lockpick docs, read on 2026-10-07
- [How we rate findings](https://www.lockpick.app/docs/security/how-we-rate-findings), Lockpick docs, read on 2026-10-07
- [What is a DNS DMARC record?](https://www.cloudflare.com/learning/dns/dns-records/dns-dmarc-record/), Cloudflare Learning Center, read on 2026-10-07