Here is how to check if email is spoofable on your business domain, free, in about two minutes. Most Southwest Michigan owners who check for the first time find the door wide open. Parallax audited 698 local businesses with live mail for our Southwest Michigan Email Security Report and found that nearly 85 percent had no DMARC enforcement at all. Here is how to check your own domain before you find out the hard way.
How Do I Check If My Business Email Can Be Spoofed?
Look up your domain's DMARC record. If it does not exist, or it is set to p=none, someone else can send email today that looks like it came from you. Your domain has two records that decide this: DMARC, which tells receiving mail servers what to do with a message that fails authentication, and SPF, which lists who is allowed to send mail as your domain. No DMARC record, or a p=none policy, means there is no instruction at all. Anyone can send a message with your name on it and it lands in someone's inbox looking legitimate.
What Does "Spoofable" Actually Mean?
It means a stranger can send an email that appears to come from your exact address, and nothing stops it. Not a lookalike domain, not a misspelled version, your actual domain. A DMARC record with an enforcement policy is what tells Gmail, Outlook, and Yahoo to quarantine or reject a message that fails to prove it is really from you. Without one, those mail servers have no instruction, so a fake invoice or a fake quote follow-up goes through looking exactly like the real thing.
The 2-Minute Manual Check
You can do this by hand with any DNS lookup tool. Look up the TXT record at _dmarc.yourdomain.com. If nothing comes back, you have no DMARC record and your domain is unprotected. If a record comes back, find the p= tag inside it. p=none means monitoring only, no enforcement. p=quarantine or p=reject means the domain is actually protected. While you are there, check that an SPF record exists too, since DMARC leans on SPF and DKIM to decide what passed. Of the 698 Southwest Michigan domains checked in Parallax's audit, 480 came back with no enforcement, either no DMARC record or p=none. That is the state most local businesses are in without knowing it.
The Fast Way: Free Instant Check
If digging through DNS records is not how you want to spend your morning, Parallax's free instant email security check does the same lookup in seconds. Type your domain, get a plain-English read of your DMARC, SPF, and MX records, nothing stored and nothing to sign up for. It is built for exactly this question: could someone send email as my business right now. Run it first, then decide if you need the deeper check.
What If My Domain Is Spoofable?
Fixing it is a DNS change project, not a rebuild. The FBI's Internet Crime Complaint Center recorded nearly $2.8 billion in business email compromise losses in 2024, and a spoofable domain is the open door that scam runs through. Fixing it means publishing a real DMARC record, watching the reports it generates for a few weeks, then tightening the policy from p=none to p=quarantine and eventually p=reject. Parallax's DMARC audit handles that whole sequence, from the first DNS change through full enforcement, if you would rather have someone else own it.
How Urgent Is This, Really?
It depends on what your check turned up. No DMARC record at all is the most exposed state, since there is zero instruction for receiving servers. p=none is better than nothing, it is actively monitoring and generating reports, but it still does not block a single fake message. If your check came back p=quarantine or p=reject, you are in genuinely good shape and this is not urgent. If it came back with nothing, or p=none, it is worth fixing this month rather than someday. Fall is also a natural time to close this out, before year-end invoicing season gives a scammer more fake invoices to send. Once you have made a change, run the instant check again to confirm the new policy is live before you consider it done.
If you want the deeper protocol background before you touch any DNS settings, what SPF, DKIM, and DMARC actually do walks through it in plain English, and the Southwest Michigan Email Security Report has the full regional numbers behind the figure above.
Frequently Asked Questions
What does the instant email security check actually look at?
It reads the records your domain publishes publicly in DNS: your DMARC policy, your SPF sender list, and whether the domain routes mail at all (MX). The lookup runs against public DNS and nothing is stored.
Why would a full audit find something the free check can't?
Signing keys (DKIM) cannot be reliably checked from outside without knowing your mail provider's selector, and no instant tool can confirm whether your real mail is actually passing these rules or catch other services quietly sending as you. A full audit verifies both and hands you an exact fix plan.
My domain shows as spoofable. How urgent is this?
It means a stranger can send email today using your exact address, and receiving servers have no instruction to stop it. The fix is a small DNS change project, not a rebuild, and most Southwest Michigan businesses Parallax audits start out in this state.
Does checking my own domain cost anything or require IT skills?
No. The manual check just needs a free DNS lookup tool like MXToolbox, and the instant checker does the same read for you with no signup.
How is this different from checking if my email is landing in spam?
Spam delivery is about your outgoing reputation. Spoofability is about whether someone else can send email as you. A domain can have great deliverability and still be wide open to spoofing. They are separate problems with separate fixes.