Live check · Public DNS only · No email required

Can someone send email pretending to be you?
Type your domain. Find out in seconds.

This is the check we run before every practice review, opened up for anyone to use. It reads your public DNS records and explains, in plain English, whether your domain is protected against impersonation. Fake invoices and bank-change requests almost always start with the gaps this finds, and practices that move client money are the favourite target.

Check a domain

Your business domain, an email address, or a website URL. We work out the rest.

Read-only · Checks public DNS records only · We log the domain checked and the result, nothing else · Limit 12 checks per hour

What this does and does not tell you

  • It checks four things: where your mail lives (MX), who may send as you (SPF), whether your mail is cryptographically signed (DKIM), and what happens to impersonation attempts (DMARC).
  • It reads public records only. Nothing touches your tenant, your mailboxes or your data. This is what anyone on the internet can already see about your domain, including attackers.
  • A good grade is not a security audit. These four checks look at your public DNS only. A Live Audit reads inside the tenant for 30 days: MFA coverage, admin accounts, Conditional Access, licence waste.
  • DKIM is probed at standard selectors for Microsoft 365 and Google Workspace. Other providers show as "not checked" rather than guessed.
Results
Nothing checked yet. Enter a domain on the left and the verdict lands here in a couple of seconds.

Try it with your own business first. Then, if you are feeling brave, the business of whoever sent you your last invoice.
↳ 30 minutes · senior engineer · no pitch

Found something that worries you?

Most of what this tool finds is fixed in an afternoon by someone who has done it before. Ask us about your result, no obligation, or get the full inside-the-tenant picture with the fixed-price audit.