Can someone send email as your business?
Most fake-invoice and “we changed our bank details” scams start with an email that looks like it came from a real local business. Type your domain to see whether yours can be faked.
Reads public DNS records only. Nothing is installed and nothing is sent to your domain or your mailboxes.
How the fix works
Your mailbox provider, website forms, invoicing, scheduling and newsletter tools. Most offices have four to seven.
Switch on DKIM signing and correct the SPF list for each sender, so genuine email proves it is yours.
Publish DMARC in watch-only mode and read the reports to catch any sender that was missed.
Tighten the policy to quarantine, then reject. Fake email stops landing; real email keeps flowing.
We ran these same steps on our own domain before offering them to anyone else.
Questions people ask
What does this check?
Three public DNS records for your domain: MX (who handles your email), SPF (the list of systems allowed to send as you) and DMARC (the policy that tells other mail servers what to do with email that fails those checks). Anyone can read these records. We only read them; we never send anything to your domain.
What does “Not protected” actually mean?
It means your domain does not tell other mail servers to block email that pretends to be you. A scammer can put your address in the From line of a fake invoice or a “we changed our bank details” message, and your customers’ mail servers have no instruction to stop it. It does not mean you have been hacked.
How common is this?
Very. In September 2026 we reviewed the public records of 135 local business domains around Broomall, PA. 122 of them, about nine in ten, had no enforced DMARC policy. We never name the businesses.
Can I just add a “reject” record myself?
Please don’t jump straight to reject. If your invoicing tool, website form, newsletter or scheduling system sends email as you and is not set up correctly, a strict policy will block your own real email. The safe order is: list every sender, switch on signing (DKIM) for each, publish DMARC in watch-only mode, read the reports, then tighten to quarantine and reject.
What can’t this tool see?
DKIM keys (they are stored under names only your mail systems know), your spam-filter and login settings, and whether mailboxes already have suspicious forwarding rules. We look at those in the free IT + AI Checkup.
Want the whole picture?
The free 30-minute IT + AI Checkup covers email, backups, logins and devices, plus the busywork AI can take off your team. You get a one-page report with your top 3 security gaps, your top 3 time and money leaks, and what we would fix first at a fixed price. If your setup is solid, the report says so.