How spoofing works
The basic email protocol lets any server write any address in the From line. Receiving servers decide whether to trust a message by checking three DNS-based mechanisms. SPF lists the servers allowed to send for your domain. DKIM adds a cryptographic signature that proves a message was signed by a key published in your DNS. DMARC ties the two to the address the recipient actually sees and tells receivers what to do when a message fails: nothing, quarantine or reject.
Only DMARC at quarantine or reject gives receivers a clear instruction to stop forged mail that uses your exact domain. Without it, a forgery can still pass through, depending on each receiver's own filters.
What the checker rates
Domains that deliberately send no mail are rated low risk when they publish a null MX record, SPF -all and DMARC reject.
- Whether SPF exists, ends in -all or ~all, and stays within ten DNS lookups.
- Whether DKIM keys are published on common selectors and are at least 1024, preferably 2048 bits.
- DMARC policy (none, quarantine, reject), the pct coverage and the subdomain policy sp.
- Alignment modes adkim and aspf, and whether you receive aggregate reports.
- A spoofing risk rating — critical, medium or low — with the reasons that led to it.
Closing the gap
If the rating is critical, publish a DMARC record with p=none and a rua reporting address today. The reports show every service sending as your domain. Make sure each legitimate one is covered by SPF or signs with DKIM for your domain, then move to p=quarantine and finally p=reject. Do not forget subdomains, which attackers also use, and parked domains you own but do not use for email.
Technical protection works best with a clear process: tell clients you will never change bank details by email, and confirm any payment instruction by phone.
Reading DMARC reports
Aggregate reports arrive as XML files, usually daily, from large mailbox providers. They list every server that sent mail using your domain and whether it passed SPF and DKIM. Free and paid report analysers turn them into readable dashboards. A few weeks of reports are normally enough to find all legitimate senders and move safely to enforcement.