See your domain the way
an attacker does.
Can someone send email in your company's name? Eight free checks answer that and more: a spoofing grade from SPF, DKIM and DMARC, lookalike domains, DMARC and SPF record generators, and an email header analyser.
Eight checks, one domain
Each one explains its result in plain language, with the raw answer underneath for whoever has to fix it, and a How to fix for anything that needs it.
Email authentication
Can someone send email as you, and does your own mail get through?
Domain spoofing test
Can someone send email as your CEO? One score, A to F, built from your SPF, DKIM and DMARC records.
/spoofingSPF checker
Syntax, the 10-lookup limit many domains quietly exceed, and whether -all or ~all actually protects you.
DMARC checker
Policy, coverage and reporting, and whether p=none is leaving the door open.
DKIM checker
Probes the selectors Microsoft 365, Google Workspace and common senders use, and checks the key length.
/dkimAnalyse and generate
Read a suspicious message, or write the records yourself.
Email header analyser
Paste the headers of a suspicious email: its path, authentication results and the mismatches phishing hides behind. Never leaves your browser.
/headersDMARC record generator
Answer a few questions, copy a valid record. Includes a safe rollout path from none to reject.
SPF record generator
Pick your mail providers and get one record that stays under the lookup limit.
/spf-generatorDomain exposure
What else about your domain an attacker can use.
Lookalike domains
Typos, swapped letters, look-alike characters and other endings of your domain, and which of them are already registered and set up for email.
/lookalikePublic data, checked in the open
Runs in your browser
The DNS lookups go from your browser straight to a public resolver. The header analyser never sends what you paste anywhere.
Public data only
Every result comes from what anyone on the internet can see. It can be wrong or out of date, so have an administrator confirm it on the systems themselves before changing anything.
No sign-up
No account, no email address, nothing to install. Open a tool, type a domain, read the result.
Records fixed? Now test the people.
SPF, DKIM and DMARC stop someone forging your domain. They don't stop a lookalike domain, or a colleague typing their password into one. Phishtime runs authorised phishing simulations against your own team, free for up to 25 employees.