Find Out If Your Domain Can Be Forged
Check your DMARC record and see whether receiving mail servers are actually told to block fake messages pretending to come from you.
DMARC is only one piece of your external exposure. Fixing it well still leaves the other seven unanswered.
The Customer Cannot Tell the Difference
A forged invoice arrives looking exactly like yours. Nothing in the message tells the person reading it that every authentication check failed.
- SmithDental Office8:47 AMAppointment Reminder · See you Thursday at 2:30.
Hi, our records show your card on file has expired. Please update your payment details before your next visit.
- LabQuest Results9:26 AMYour Results Are Ready · The panel from Monday is available.
- DMARC policyNone published
- SPF resultSoft fail
- DKIM signatureMissing
- Sent by this companyNo
- Delivered anywayYes
- Anything shown to the readerNothing
What DMARC Decides
Three questions, answered in order. DMARC is the third one, and without it the first two produce evidence nobody acts on.
Who is allowed to send as you?
SPF lists the servers. DKIM signs the message. Together they produce a pass or a fail for every message claiming to be from your domain.
What should happen when they fail?
Your DMARC policy answers this: do nothing, send it to spam, or refuse it outright. This is the part most domains never publish.
Are unknown senders actually blocked?
Only if the policy says reject. A published record with no instruction looks handled and stops nobody.
Reading Your Result
No DMARC Record
Nothing tells receiving servers to refuse forged mail.
Anyone can attempt to send email appearing to come from your domain, and most of it will be delivered.
p=none
A record exists and instructs servers to take no action.
You can see the problem in reports, but receiving servers are not required to stop anything.
p=quarantine
Forged mail is directed to spam rather than the inbox.
A real improvement. The message still arrives somewhere your customer can find it.
p=reject
Forged mail is refused outright.
This is the setting that actually stops someone sending email in your name.
What a Record Looks Like
Fix It Without Breaking Your Business Email
Check SPF and DKIM First
DMARC reads their results. Publish it before either exists and it has nothing to act on.
Start at p=none With a Reporting Address
Nothing changes for any sender. You are only collecting data at this stage.
Read the Reports for Two to Four Weeks
This is where the forgotten services surface: the reminder tool, the invoicing platform, an old marketing account.
Authorize the Real Senders
Anything still failing after this is either an impostor or something nobody remembers signing up for.
Move to Quarantine, Then Reject
Tighten in stages. Jumping straight to reject is how a practice discovers its reminders were never authorized.
Why It Is Worth Ten Minutes
Impersonation Is Cheap
Large companies enforce DMARC. A dental practice or a contractor usually does not, so they are the easier target.
It Does Not Look Like an Attack
A fake invoice does not look like a technical failure. It looks like your company made a mistake.
The Money Does Not Come Back
Your customer pays the wrong account, and the bank does not return it. The relationship absorbs the damage.
DMARC Is One of Eight
DMARC is only one piece of your external exposure. A domain can enforce it perfectly and still fail most of what a stranger can see.
Common Questions
Yes. DMARC works by checking their results, so a DMARC record without at least one of them properly configured has nothing to evaluate.
It can if you move to reject before confirming every legitimate sender passes. That is why the staged approach exists. At p=none nothing changes for anyone.
No. DMARC protects against impersonation of your exact domain. It does not prevent a compromised mailbox, a lookalike domain one character different, or exposure in other categories. That is why Blindspot checks eight of them rather than one.
Publishing is a DNS change that takes about ten minutes. Reading the reports before tightening the policy is the part that takes weeks.
No. This is not a penetration test. It reads public records only, specifically the DMARC record published in your domain's DNS, which anyone can look up. Nothing is logged into, no password is tested, and no network is touched.
Your Email Is Only One Door
DMARC answers one question. Blindspot answers the other seven.
We only read public records. We never touch your computers and we never ask for a password.
Keep Reading
Three places this leads next, depending on what you want to do about it.
- Free ToolFind Out Who Can Send Email As Your CompanyCheck your domain's SPF record, terminal policy, and supported DNS lookup count. Get a free result with no login, software, or private network access.
- Free ToolHow to Stop Email SpoofingEmail spoofing is stopped with three DNS records, not with software. Here is what spoofing actually is, why filters cannot catch it, and the exact steps that block someone sending mail as your company.
- ExplainerEmail SpoofingEmail spoofing forges the sender address on a message. Here is how spoofing an email actually works, why the protocol allows it, how to tell a spoofed email, and what stops it.