UtilForge

Domain Email Check

For businesses · reads public records · New

Could someone send invoices as your business?

Reads public records onlyNo sign-upNo trackingPlain-English result

Fake invoices and “new banking details” emails often use a business’s own domain, the part after the @. Type yours and see what the public records say about whether other people can send email in its name. The check reads only public records, never your mailboxes or systems.

The short answer. Three public records decide how easily a domain can be impersonated: the Sender Policy Framework record, the DomainKeys Identified Mail signature and the Domain-based Message Authentication, Reporting and Conformance policy. This page reads all three and tells you what to ask your email provider for.

How it works, in four steps

  1. Type your business email domainThe part after the @, for example yourbusiness.co.za.
  2. The page reads public recordsIt asks a public Domain Name System service, run by Cloudflare, for the same records any mail server reads.
  3. See what is in place and what is missingEach record is explained in plain words.
  4. What this check cannot doIt cannot see your mailboxes, and it cannot stop a look-alike domain such as a spelling variation.

Your business email domain

What leaves your device

This check needs the internet. The domain you type is sent to Cloudflare’s public Domain Name System service, which answers questions about public records, exactly as a mail server asks them when it receives a message. The page’s security setting allows only that one connection. UtilForge.org does not receive, keep or log the domain, and the page keeps no copy of it once you close the tab.

Why these three records

When a message arrives, the receiving mail server looks for three public records published by the sender’s domain. The Sender Policy Framework record lists which servers may send mail for the domain. The DomainKeys Identified Mail record lets the receiver check a signature that shows the message was not changed on the way. The Domain-based Message Authentication, Reporting and Conformance record tells the receiver what to do when a message fails those checks (nothing, put it in junk, or refuse it) and where to send reports.

A domain with no policy leaves that choice to each receiver, and many accept the message. That is how an email can arrive in a client’s inbox showing your exact address, asking them to pay a new account.

What this check cannot do

It reads three public records. It cannot see your mailboxes, your passwords or your systems. Common signature names are tried, so a signature stored under an unusual name may show as not found; your email provider can confirm. A well-protected domain does not stop a look-alike domain, such as one letter changed or a hyphen added, and it does not help if someone has taken over a real mailbox. Treat any request to change bank details as a reason to phone the person on a number you already hold.

Questions and answers

What does this check actually do?

It asks a public Domain Name System service for three records your domain publishes and explains what they allow. It does not touch your email accounts or systems.

If my result is good, can scammers still send fake invoices?

They can still use a look-alike domain, or a real mailbox they have taken over. A good result closes one door, the exact copy of your address. Phone to confirm any change of bank details.

I am not technical. What do I do with a poor result?

Copy the note on this page and send it to whoever runs your email, your provider or your information technology support. It names exactly what to ask for.

Does UtilForge.org keep the domain I type?

No. The domain goes from your browser to Cloudflare’s public Domain Name System service, as it does whenever a mail server checks it. UtilForge.org does not receive it.

Why does this tool need the internet when others work offline?

Public records live on the internet, so there is nothing to read offline. The other UtilForge checks use only what you paste into the page.

Keep going

Related tools

For businesses

Did this check help you?

Tell UtilForge what worked and what did not. Each button opens an email to lindsay@utilforge.org that you write and send yourself. UtilForge will only quote your words on this site if you say it may, and then with your first name and country only.

Yes, it helpedSomething was missing

The whole method in one book. “How to Become Safer Online” is a free 171-page large-print guide to the five steps most scams follow, and what to do if money or details have already gone. Read or print the free book.