Free check, no sign-up

Can your domain be spoofed?

Enter your company domain. We read its public DNS and tell you, in plain English, whether someone can send email in your name and what to ask your IT provider. This is a check for you, not for us. Nothing is logged and nothing is stored.

Privacy: runs only in your browser, so we never see the domain you check.

Why most South African domains fail this

We checked 58,769 South African business domains in 2026. 84% can be spoofed. Not because anyone was careless. Their mail host set up email that way, and nobody has changed it since.

If your IT is outsourced, "security included" usually means antivirus, backups and a spam filter. These records are nobody's job, so nobody does them. Read the full story.

The three records

  • SPF lists who may send as you. Only bites with -all and an enforcing DMARC.
  • DKIM signs each message with a key in your DNS. Without it, enforcing DMARC junks your own forwarded mail.
  • DMARC is the instruction: p=none, p=quarantine or p=reject, plus where to send reports.

Lookalike domains

SPF, DKIM and DMARC only govern your own domain. They say nothing about yourcompany.com when you own yourcompany.co.za, or about a spelling one letter off. Mail from a domain like that passes every check, because whoever registered it is telling the truth about a domain they really do own.

Run the check above and there is a button underneath the results that generates the usual near-misses of your domain, mistyped letters, swapped pairs, added hyphens, the same name under other TLDs, and asks public DNS which ones are already registered. The ones with a mail server are the ones to worry about.

What this cannot tell you

It reads DNS only: not whether your mail is actually signed, whether anyone reads the reports, or how your inbound filter judges what a genuine message is asking for. The expensive frauds pass all three checks from a real, compromised supplier mailbox. Closing your domain protects your name. Protecting your inbox is a different control.

Questions

What does this check look at?
Your domain's public DNS: the SPF record, the DMARC record, DKIM keys under common selector names, and the MX records that show who hosts your mail. These are the same records a receiving mail server reads when it decides whether a message claiming to be from you is genuine.
Do you see the domain I check?
No. The lookups run from your browser to Cloudflare's public DNS-over-HTTPS resolver. Nothing is sent to CyberFrame's servers, and nothing is stored.
Why does my mail host's default matter?
In our 2026 check of 58,769 South African business domains, whether a domain enforced DMARC depended on the mail host far more than on company size. Most hosts set up SPF, leave DKIM as a manual step, and never create a DMARC policy that rejects anything. Only 15.7% of domains enforce, and 3.6% are fully closed.
Can this find lookalike domains?
Yes. After the main check there is a button that generates a few hundred near-misses of your domain and asks public DNS which are registered. A lookalike owned by somebody else passes SPF, DKIM and DMARC, because the sender is telling the truth about their own domain, so nothing you publish in your DNS can stop it.
My IT provider says security is included. Should this be done already?
Usually "security included" means antivirus, backups, patching and a spam filter. SPF, DKIM and DMARC fall between the registrar, the web host, the mail host and the IT provider, and are rarely in anyone's contract. Ask who owns them.