CanIBeSpoofed: Free email spoofing test
Can someone send email pretending to be your domain? Check your SPF and DMARC records for spoofing weaknesses, see every server allowed to send as you, and get plain-language fixes. Results in seconds, no sign-up.
- SPF & DMARC checks
- Sender map
- No sign-up
What your report shows
- A clear verdict: can your domain be spoofed?
- Every SPF and DMARC issue, rated by severity
- Your records, colour-coded word by word
- Your mail gateway and its spam and malware filters
- Every server that can send as you, mapped and checked against spam blocklists
What the test checks
Your whole email supply chain
Spoofing protection isn't one record. CanIBeSpoofed looks at the rules that say who may send as you, the gateways that receive your mail, and every server your SPF record lets in.
3layers checked
-
Configuration checks
SPF & DMARC
The rules that tell receivers which servers may send as you, and what to do with mail that fails.
- Missing, weak or over-permissive SPF records
- The 10-lookup limit and duplicate includes
- DMARC policies that only monitor, or cover part of your mail
-
Gateways & filters
Mail receivers
The servers that accept your incoming mail, and the spam and malware filters that guard them.
- Your MX records and mail gateway
- Spam and malware filtering technology
- Filters that can be bypassed
-
IPs & locations
Mail senders
Every IP address your SPF record allows to send as you, found by following each include to the end.
- Who owns each sender, and where it is
- A world map of your sending servers
- Senders listed on spam blocklists
-
Scanning automation
Scan domains programmatically with the CanIPhish API, or run the open-source GitHub project locally.
-
Historic searching
Signed-in users can find every domain they've scanned, with its latest result, in their dashboard.
-
DMARC monitoring
Ready to enforce DMARC? Domain Protection reads your DMARC reports and shows who sends as you.
How it works
From domain name to fix list in seconds
Email spoofing works because receivers can't tell a real message from a forged one unless your DNS tells them how. The test reads what your DNS says, the way a receiving mail server would.
-
Enter your domain
The part after the @ in your email address, such as yourcompany.com. No account, no email address.
-
We read your records
Your SPF, DMARC and MX records, then every include inside your SPF record, all the way down.
-
Every issue, rated
Each issue is rated from Low to Very High by how likely a receiver is to accept a forged email in your name.
-
Fix and re-scan
Every issue comes with an explanation. Change your DNS, scan again and watch the verdict turn green.
Reading your results
What the severities mean
Severity follows one question: how likely is a receiving mail server to accept a spoofed email from your domain?
-
Very High
Even receivers with hardened spam and spoofing checks will accept spoofed mail, because attackers can send SPF-authenticated email as your domain.
-
High
Receivers with moderate spam and spoofing checks will accept spoofed mail. They have little or no way to authenticate your domain.
-
Medium
Receivers with relaxed checks will accept spoofed mail. Your settings leave room for doubt that stricter receivers may not forgive.
-
Low
Usually no direct spoofing risk, but it can hurt the delivery of your legitimate email or stop the scan from finishing.
-
Mitigated
A real issue, but your DMARC policy already covers it, so receivers that enforce DMARC will reject the spoofed mail or send it to spam.
The overall verdict is the most severe issue found: Very High or High means your domain, or its sub-domains, can be spoofed. Read the full FAQs
Deep dive
CanIBeSpoofed features
A closer look at what the email spoofing tool analyses, and why each layer matters.
Full feature listIdentify spoofing issues in your SPF and DMARC records
Our email spoofing tool runs a series of SPF and DMARC configuration checks to make sure your domain is protected from email spoofing and spam.
They include checking that your domain has an SPF record, that its 'all' mechanism is set correctly and that it stays within the lookup limit receivers enforce, and looking for insecure DMARC policies. We also identify issues such as missing sub-domain records and partial DMARC coverage, so you can be confident your domain is protected against spoofing and your real email isn't flagged as spam.
Understand your email receiver infrastructure
Improve your email security with the proprietary techniques our email spoofing tool uses to identify your email gateway, spam filter and malware filter technologies.
We identify these technologies from your MX records: Microsoft Exchange Online and Exchange Online Protection, Google Mail, Yahoo Mail, Cisco IronPort, Proofpoint SEG, Mimecast SEG, Symantec MessageLabs, Barracuda Email Security, FireEye ETP Cloud, Forcepoint Cloud and Bitdefender GravityZone. Behind a filtering gateway, we also check whether mail can skip the gateway and go straight to Microsoft 365.
Understand your email sender infrastructure
Our recursive SPF querying finds every IP address allowed to send email as your domain, by reading your SPF record and every record it includes. We also collate who owns each address, so you can see exactly who operates your downstream mail sender infrastructure.
Visualise the geolocation of your email senders
The email spoofing tool looks up the location of every sender and shows it both as a table and on a world map.
This helps you spot geolocation-driven risks and make informed decisions. For example, a government agency would want to avoid email infrastructure owned by a hostile nation's ISP and operated from inside that nation.
Identify malicious email senders
Every IPv4 sender is checked against the Spamhaus ZEN blocklist. The tool flags addresses associated with:
- unsolicited bulk email, spam operations and spam services (low-reputation senders);
- snowshoe spam, which actively tries to evade spam detection;
- hijacked hosts infected by third-party exploits, including open proxies (HTTP, SOCKS, AnalogX, WinGate and others), worms and viruses with built-in spam engines, and other trojan-horse exploits;
- end-user (non-MTA) addresses that ISPs allocate to residential users.
About the tool
What is CanIBeSpoofed?
CanIBeSpoofed was the first tool CanIPhish built, before the CanIPhish platform existed. It was made to give businesses not just an email spoofing test but a single place to understand a domain's whole email landscape.
It does this by passively analysing DNS records and public data about a domain's mail servers to find weaknesses that expose a business to unnecessary risk.
CanIBeSpoofed is free, open source on GitHub and built into the CanIPhish platform. Curious what it would find for you? Run a free scan and see.
Your next move
Is your domain vulnerable to spoofing?
Depending on whether you already have buy-in to fix it, take one of two paths.
-
Show the risk with a real-world test
Replicate the steps an attacker would take to spoof your domain, in a controlled demonstration, to show why your SPF and DMARC records need securing.
How to spoof an email address in 5 steps -
Secure your SPF and DMARC records
Follow industry best practice to implement SPF and DMARC securely, so attackers have no room left to spoof your domain.
How to create a secure SPF record in 5 steps
For security & IT teams
Found the gap? Now show your team the impact
A spoofing test shows what attackers can send. CanIPhish shows how your people respond: realistic phishing simulations, security awareness training that follows up automatically, and DMARC monitoring to shut spoofing down for good.
- Realistic phishing simulations
- Security awareness training
- DMARC monitoring with Domain Protection
- Reporting for every campaign
No trial periods. No credit cards. No sales calls.
FAQ
Email spoofing test: your questions
What the test does, what it doesn't, and what to do with your results.
Scan a domain More FAQsWhat is an email spoofing test?
An email spoofing test checks whether someone else could send email that looks like it came from your domain. CanIBeSpoofed reads your domain's public SPF and DMARC records, checks them for spoofing weaknesses and tells you in plain language whether receiving mail servers would accept a forged email in your name, and what to fix if they would.
Is the email spoofing test free? Do I need an account?
Yes, it's free, and you don't need an account to scan a domain. If you create a free CanIPhish account, the domains you scan are saved to your account, so you can come back to them and see each one's latest result.
Does the test send email or change anything on my domain?
No. The scan only reads public information: your domain's DNS records (SPF, DMARC and MX) and public data about the IP addresses your SPF record allows to send, such as who owns them, where they are and whether they're on a spam blocklist. It doesn't email your users and it can't change your DNS.
What's the difference between SPF, DKIM and DMARC?
SPF lists the servers allowed to send email for your domain. DKIM adds a cryptographic signature to each message, so receivers can check it wasn't forged or changed on the way. DMARC ties the two together: it tells receivers what to do with mail that fails them (monitor it, send it to spam or reject it) and where to send reports. Only a DMARC policy of quarantine or reject actually stops spoofed email being delivered. This test checks SPF and DMARC. DKIM keys are published under selector names that can't be discovered from DNS, so they aren't scanned.
Why are some issues marked Mitigated?
Some SPF weaknesses stop mattering once DMARC is enforcing. When your DMARC policy is quarantine or reject and covers all of your mail, receivers that check DMARC will reject forged mail or send it to spam even where SPF on its own wouldn't catch it, so we mark those SPF issues as Mitigated. They're still worth tidying up.
My domain can be spoofed. How do I fix it?
Most fixes are a DNS change. Make sure your SPF record lists every service that sends email for you, ends in -all and needs no more than 10 DNS lookups; our guide How to create a secure SPF record in 5 steps walks you through it. Then publish a DMARC record and move its policy from p=none to p=quarantine and then p=reject once your reports show all of your real email passing. CanIPhish Domain Protection reads those reports for you and tells you when it's safe to take each step.
Can I scan domains automatically?
Yes. CanIBeSpoofed is open source on GitHub, so you can run the same kind of checks on your own machine, and CanIPhish account holders can scan domains programmatically through the CanIPhish API.