For the complete site index, see llms.txt. Docs index: llms-docs.txt. Marketing corpus: llms-full.txt. Docs corpus: llms-full-docs.txt. Prefer markdown URLs where available (append .md).. Product skill: skill.md. Pricing: pricing.md. Docs MCP: /docs/mcp.

Free Tools

Free Email Spoofing Checker

Find out if someone can send email pretending to be you. We read your public SPF, DKIM and DMARC records and show whether Gmail, Yahoo and Outlook would deliver a fake. Free, no sign-up.

Best features

Why choose Reloop's email spoofing checker?

Free, no account needed, and read straight from your domain's public DNS.

100% Free & No limits

This checker is free. It needs no signup and has no credits or expiry.

See what a fake would do

We show whether a forged email from your domain lands in the inbox, goes to spam, or gets blocked.

Plain-English reasons

Every finding from DMARC, SPF and DKIM is explained, with the raw records one click away.

No Account Needed

Use the checker or the API without an account or an API key. We never send email.

Who is it for

Where can I use Reloop's email spoofing checker?

Anyone who needs to know if a domain can be impersonated over email.

Security teams

  • Phishing risk reviews
  • CEO fraud prevention
  • Invoice fraud defense
  • Vendor risk audits
  • Pen test prep
  • Compliance evidence
  • Incident follow-up

Email admins

  • DMARC rollout
  • Moving off p=none
  • Subdomain policy checks
  • SPF cleanup
  • New domain setup
  • Migration checks
  • Parked domain lockdown

Founders & IT

  • Company domain checks
  • Brand protection
  • Customer trust
  • Board security reports
  • Insurance questionnaires
  • M&A due diligence
  • Agency client audits

Developers

  • Customer domain onboarding
  • Custom sending domains
  • Multi-tenant sending
  • Signup risk scoring
  • Security dashboards
  • Automated audits
  • Internal tooling
API integration

Integrate today in your code

One request tells you whether a domain can be spoofed and why. No API key or account needed.

Body

domainstringrequired
Domain or URL to check (e.g. stripe.com). We read its public SPF, DKIM and DMARC records; no email is sent.

Request

// No SDK, no API key: it is a plain POST.
const res = await fetch(
  "https://reloop.sh/api/tools/v1/spoof-checker",
  {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ domain: "stripe.com" }),
  },
);


const result = await res.json();
Sample Response
{
  "domain": "stripe.com",
  "resolvedAt": "2026-08-31T12:00:00.000Z",
  "responseTimeMs": 42,
  "spoofable": false,
  "verdict": "protected",
  "headline": "No, receivers are told to reject fakes as you@stripe.com",
  "summary": "Your domain enforces strict DMARC ('p=reject') and SPF protection. Major mailbox providers are instructed to discard fraudulent emails.",
  "inboxOutcome": "rejected",
  "dmarc": {
    "published": true,
    "policy": "reject",
    "subdomainPolicy": "reject",
    "percentage": 100,
    "rawRecord": "v=DMARC1; p=reject; rua=mailto:dmarc-reports@stripe.com; pct=100; aspf=s"
  },
  "spf": {
    "published": true,
    "qualifier": "~all",
    "lookupCount": 1,
    "rawRecord": "v=spf1 include:_spf.google.com ~all"
  },
  "dkim": {
    "published": true,
    "selector": "s1",
    "keyLength": 2048
  },
  "mx": {
    "published": true,
    "provider": "Google Workspace"
  },
  "reasons": [
    {
      "id": "dmarc-protected",
      "severity": "success",
      "title": "Strict DMARC Policy ('p=reject')",
      "detail": "Mailbox providers will drop and reject any message pretending to come from your domain that fails authentication."
    },
    {
      "id": "spf-valid",
      "severity": "success",
      "title": "SPF Configured ('~all')",
      "detail": "Legitimate sending servers are specified with 1/10 DNS lookups."
    }
  ],
  "nextStep": {
    "title": "Your domain is protected",
    "body": "Send transactional and marketing emails through Reloop with full SPF, DKIM, and DMARC alignment without weakening your security policy.",
    "href": "/dashboard/signup"
  },
  "subdomainNote": null
}
All tools

Explore all free email & developer tools

More free utilities for checking deliverability, DNS records, and email authentication before you hit send.

W: 320.0px180R20∠45.0°

Lock down your domain.
Send with Reloop.

Reloop sets up SPF, DKIM and DMARC for your sending domain so fakes get rejected and real mail lands. Start with 3,000 free emails per month.

Get started freeTalk to founder

FAQ

Frequently asked questions.

Enter your domain in the spoofing test above. It reads your public SPF, DKIM, and DMARC records and tells you in plain English whether Gmail, Yahoo, and Outlook would deliver a forged email sent from your domain. Nothing is sent, so it's safe to run on any domain you own.

Email protocols (SMTP) do not verify sender identity by default. A stranger can configure their mail server to send emails displaying your company's domain in the 'From:' header (e.g. ceo@yourcompany.com) without having access to your email passwords or servers.

'p=none' is a telemetry-only policy. It tells receiving servers: 'Monitor authentication failures and send me reports, but deliver the email to the recipient anyway.' Attackers can still spoof your domain until you upgrade to 'p=quarantine' or 'p=reject'.

No. SPF only checks the Return-Path (envelope sender) address, not the visible 'From:' address that users see in Gmail or Outlook. Only DMARC enforces alignment between SPF, DKIM, and the visible 'From:' address.

If your root domain is set to 'p=reject' but specifies 'sp=none', attackers cannot spoof '@yourdomain.com' but can still easily spoof '@mail.yourdomain.com' or '@billing.yourdomain.com'.

1. Ensure all legitimate email providers (Google Workspace, Reloop, etc.) are included in your SPF record and sign with DKIM. 2. Publish a DMARC policy starting at 'p=none' with an aggregate reporting address (rua=). 3. Review reports and upgrade to 'p=quarantine', then permanently enforce 'p=reject; pct=100'.

No. Sending unauthorized emails without permission is unsafe and prohibited. This tool simply inspects your public DNS records across global resolvers to evaluate the exact rules mailbox providers apply when receiving unauthorized messages.

Reloop