For the complete site index, see llms.txt. Docs index: llms-docs.txt. Marketing corpus: llms-full.txt. Docs corpus: llms-full-docs.txt. Prefer markdown URLs where available (append .md).. Product skill: skill.md. Pricing: pricing.md. Docs MCP: /docs/mcp. Site MCP: /mcp.

Domain Security & Anti-Spoofing Tool

Can Anyone Spoof My Domain?

Find out in plain English if someone can send emails pretending to be you. Check whether Gmail, Yahoo, and Outlook will deliver unauthorized fake emails using your domain.

Try Presets:

We do not send test emails. We only query public DNS records across global root resolvers.

Why domain spoofing protection matters.

Phishing and CEO fraud cost businesses billions every year. Protect your brand reputation and customers from forged emails.

Stop Invoice & CEO Fraud

Attackers forge 'ceo@yourcompany.com' or 'finance@yourcompany.com' to trick employees into wiring money or changing bank accounts.

The DMARC 'p=none' Blindspot

Publishing DMARC with 'p=none' collects monitoring reports, but explicitly tells Gmail and Outlook to deliver fake emails anyway.

Protect Brand & Customer Trust

When your domain is strictly locked, phishing attempts using your exact From address are discarded before reaching your customers.

2024+ Inbox Enforcement

Major mailbox providers reject unaligned sending domains to combat phishing. Secure domains enjoy higher deliverability.

Check domain spoofability via API.

Integrate automated domain impersonation tests into your security dashboard or customer onboarding pipeline.

1

Install the Node.js package

npm install reloop-email
2

Check email spoofability with Node.js

check_spoof.ts
1import Reloop from 'reloop-email';
2

3const reloop = new Reloop(process.env.RELOOP_API_KEY);
4

5const report = await reloop.tools.spoofChecker({
6  domain: 'stripe.com',
7});
8

9console.log(`Verdict: ${report.verdict} (Spoofable: ${report.spoofable})`);
10console.log(`Headline: ${report.headline}`);
11console.log(`Inbox Outcome: ${report.inboxOutcome}`);
3

Inspect JSON spoofability report (200 OK)

response.json
1{
2  "domain": "stripe.com",
3  "resolvedAt": "2026-08-31T12:00:00.000Z",
4  "responseTimeMs": 42,
5  "spoofable": false,
6  "verdict": "protected",
7  "headline": "No — receivers are told to reject fakes as you@stripe.com",
8  "summary": "Your domain enforces strict DMARC ('p=reject') and SPF protection. Major mailbox providers are instructed to discard fraudulent emails.",
9  "inboxOutcome": "rejected",
10  "dmarc": {
11    "published": true,
12    "policy": "reject",
13    "subdomainPolicy": "reject",
14    "percentage": 100,
15    "rawRecord": "v=DMARC1; p=reject; rua=mailto:dmarc-reports@stripe.com; pct=100; aspf=s"
16  },
17  "spf": {
18    "published": true,
19    "qualifier": "~all",
20    "lookupCount": 1,
21    "rawRecord": "v=spf1 include:_spf.google.com ~all"
22  },
23  "dkim": {
24    "published": true,
25    "selector": "s1",
26    "keyLength": 2048
27  },
28  "mx": {
29    "published": true,
30    "provider": "Google Workspace"
31  },
32  "reasons": [
33    {
34      "id": "dmarc-protected",
35      "severity": "success",
36      "title": "Strict DMARC Policy ('p=reject')",
37      "detail": "Mailbox providers will drop and reject any message pretending to come from your domain that fails authentication."
38    },
39    {
40      "id": "spf-valid",
41      "severity": "success",
42      "title": "SPF Configured ('~all')",
43      "detail": "Legitimate sending servers are specified with 1/10 DNS lookups."
44    }
45  ],
46  "nextStep": {
47    "title": "Your domain is protected",
48    "body": "Send transactional and marketing emails through Reloop with full SPF, DKIM, and DMARC alignment without weakening your security policy.",
49    "href": "/dashboard/signup"
50  },
51  "subdomainNote": null
52}

Frequently asked questions.

Everything you need to know about email spoofing, DMARC policies, SPF alignment, and inbox protections.

Ship your first email in minutes

Open-source, deliverability-focused, and yours to self-host or run on Reloop Cloud. No lock-in, no rewrite later.

Get started freeDocumentation
Reloop