Home › Domain check
Email and domain checker
Can someone spoof your company's email? Check your domain
Enter your domain and see in seconds how your email is set up: SPF, DKIM, DMARC and MX. We only check what your domain already publishes on the internet; we don't scan your systems. Results appear on screen, with no sign-up needed.
When you run the check, your browser queries the domain's public DNS records via Cloudflare's DNS service (1.1.1.1). vrtxcloud neither receives nor stores the domain or the result. More information.
Your result
Enter a domain above and click “Check my domain”. JavaScript must be enabled.
What we check on your domain
- DMARC: whether it exists and which policy it applies (
none,quarantineorreject). This is the key check for whether your email can be spoofed. - SPF: whether there is a single record, how it ends (
-all,~all,?all) and how many DNS-lookup mechanisms it has at the top level (the standard limits the total to 10). - DKIM: whether we detect a signature using the most common selectors.
- MX: where your email is received.
- Informational extras: MTA-STS, TLS-RPT, CAA and DNSSEC.
How to read the traffic-light rating
- Red: no DMARC, or SPF missing, duplicated or too permissive. Anyone can send emails that appear to come from your domain.
- Amber: DMARC set to
noneor SPF with~all. There are warnings, but the policy that rejects or quarantines fake messages is missing. - Green: SPF and DMARC correctly published. That doesn't mean “secure”: it doesn't cover look-alike domains or accounts with stolen passwords.
What you can do with the result
- Fix it yourself, or have your IT provider fix it, using the information in the result.
- Have us review it: Basic Audit. Fixed quote after diagnosis, with a fixed scope.
- If you've already been impersonated: incident response (fixed quote after diagnosis).
What we don't do
This is a passive check of public data. We don't run penetration tests, scan ports or access accounts. Any analysis beyond public information requires signed authorisation. The website side (HTTPS, certificate and headers) can't be checked from a browser and is covered in the Full Audit.
Frequently asked questions
How do I know if my company email can be spoofed?
Check whether your domain publishes a DMARC record and with which policy. Without DMARC, or with the “none” policy, receiving servers have no instructions to reject messages that use your domain without permission. The checker on this page queries SPF, DKIM (if it detects the selector), DMARC and MX, and shows you a traffic-light result.
Do you store the domain I check?
No. The lookup is made by your own browser to Cloudflare's public DNS service; this website has no form server or database, so vrtxcloud receives neither the domain nor the result. We only see it if you choose to email it to us.
Why does my DKIM signature show as “not detected”?
The DKIM selector isn't public: you need to know its name to check it. The checker tries the most common selectors, but there may be a valid signature under a different name. In the audit, we confirm it with your email provider.
Does a green result mean I am protected?
No. Green means SPF and DMARC are correctly published. It doesn't protect you against look-alike domains or an email account with a stolen password. It's a passive check of public data, not a penetration test.
What should I do if the result is red?
You or your IT provider can fix it using the information in the result. If you'd rather we review it, there's the Basic Audit: fixed quote after diagnosis, with the scope set in writing. If you've already been impersonated, see incident response.
What do SPF, DKIM and DMARC do?
SPF lists the servers allowed to send mail for your domain. DKIM adds a cryptographic signature proving a message was not altered. DMARC ties both together and tells receivers what to do when checks fail, and it sends reports showing who is sending mail using your domain.
Does the checker store my domain?
No. Your browser queries public DNS records through Cloudflare’s resolver, and VRTXCLOUD neither receives nor stores the domain or the result. The tool only reads what your domain already publishes. It does not scan your systems, ports or accounts, and you do not need to register to see the result.
Does DMARC protect against every email threat?
No. DMARC protects your exact domain against direct impersonation. It does not stop lookalike domains with one letter changed, compromised accounts or malicious attachments sent from other addresses. It is one important layer of email security, not a complete defence.
References: Google's email sender guidelines · RFC 7208 (SPF) · INCIBE, compromised email fraud. Methodology reviewed by Fabio Guimaraes · last updated: October 2026.