You can check whether your business email is spoofable in about two minutes, for free. Most Southwest Michigan owners who check for the first time find the door wide open. Parallax checked 1,527 local businesses for our Southwest Michigan Email Security Report. Of the 847 that email from their own domain, 79.2 percent had no DMARC enforcement at all. Here is how to check your own domain before you find out the hard way.
How Do I Check If My Business Email Can Be Spoofed?
Look up your domain's DMARC record. If it does not exist, or it is set to p=none, someone else can send email today that looks like it came from you. Your domain has two records that decide this: DMARC, which tells receiving mail servers what to do with a message that fails authentication, and SPF, which lists who is allowed to send mail as your domain. No DMARC record, or a p=none policy, means there is no instruction at all. Anyone can send a message with your name on it and it lands in someone's inbox looking legitimate.
What Does "Spoofable" Actually Mean?
It means a stranger can send an email that appears to come from your exact address, and nothing stops it. Not a lookalike domain, not a misspelled version, your actual domain. A DMARC record with an enforcement policy is what tells Gmail, Outlook, and Yahoo to quarantine or reject a message that fails to prove it is really from you. Without one, those mail servers have no instruction, so a fake invoice or a fake quote follow-up goes through looking exactly like the real thing. For how that plays out for a small business, and what it tends to cost when it does, see can someone send emails pretending to be my business.
The 2-Minute Manual Check
You can do this by hand with any DNS lookup tool. Look up the TXT record at _dmarc.yourdomain.com. If nothing comes back, you have no DMARC record and your domain is unprotected. If a record comes back, find the p= tag inside it. p=none means monitoring only, no enforcement. p=quarantine or p=reject means the domain is actually protected. While you are there, check that an SPF record exists too, since DMARC leans on SPF and DKIM to decide what passed. Of the 847 businesses that email from their own domain in Parallax's check of 1,527 Southwest Michigan businesses, 671 had no enforcement: 390 had no DMARC record at all, 275 were set to p=none, and 6 published a broken record. That is the state most local businesses are in without knowing it.
The Fast Way: Free Instant Check
If digging through DNS records is not how you want to spend your morning, Parallax's free instant email security check does the same lookup in seconds. Type your domain, get a plain-English read of your DMARC, SPF, and MX records, nothing stored and nothing to sign up for. It is built for exactly this question: could someone send email as my business right now. Run it first, then decide if you need the deeper check.
What If My Domain Is Spoofable?
Fixing it is a DNS change project, not a rebuild. The FBI's Internet Crime Complaint Center recorded just over $3 billion in business email compromise losses in 2025, and a spoofable domain is the open door that scam runs through. Fixing it means publishing a real DMARC record, watching the reports it generates for a few weeks, then tightening the policy from p=none to p=quarantine and eventually p=reject. Parallax's DMARC audit handles that whole sequence, from the first DNS change through full enforcement, if you would rather have someone else own it.
How Urgent Is This, Really?
It depends on what your check turned up. No DMARC record at all is the most exposed state, since there is zero instruction for receiving servers. p=none is better than nothing, it is actively monitoring and generating reports, but it still does not block a single fake message. If your check came back p=quarantine or p=reject, you are in genuinely good shape and this is not urgent. If it came back with nothing, or p=none, it is worth fixing this month rather than someday. Fall is also a natural time to close this out, before year-end invoicing season gives a scammer more fake invoices to send. Once you have made a change, run the instant check again to confirm the new policy is live before you consider it done.
If you want the deeper protocol background before you touch any DNS settings, what SPF, DKIM, and DMARC actually do walks through it in plain English, and the Southwest Michigan Email Security Report has the full regional numbers behind the figure above.
Frequently Asked Questions
Does checking my own domain cost anything or require IT skills?
No. The manual check just needs a free DNS lookup tool like MXToolbox, and the instant checker does the same read for you with no signup.
How is this different from checking if my email is landing in spam?
Spam delivery is about your outgoing reputation. Spoofability is about whether someone else can send email as you. A domain can have great deliverability and still be wide open to spoofing. They are separate problems with separate fixes. If the trigger was a strange email that claimed to come from you, postmortem.report's free in-browser email checks read the message headers on your own machine, so nothing gets uploaded.