Can someone fake your company email?

What these checks mean

SPF: who may send your email

A public list of the services allowed to send email for your domain, such as Microsoft 365 or your newsletter tool. Mail from anywhere else looks suspicious to the receiving server.

DKIM: a signature on every email

Your email service signs each message. The receiver checks the signature against a key published in your domain, which proves the email is really from you and wasn’t changed on the way.

DMARC: what to do with fakes

Tells receiving servers what to do with email that fails SPF and DKIM: deliver it anyway (“none”), send it to spam (“quarantine”) or block it (“reject”). Without it, fake emails in your name usually still get delivered.

BIMI: your logo next to your emails

An optional extra that shows your company logo beside your emails in Gmail, Yahoo and Apple Mail, which helps customers spot the real thing. It only works once DMARC blocks fakes (quarantine or reject), and Gmail and Apple Mail also want a paid logo certificate (VMC or CMC). We show it in the check, but it doesn’t count toward the score.

Why it matters now

Fake invoices and “please update our bank details” emails sent in a real company’s name are one of the most common ways small businesses lose money. Since 2024 Google and Yahoo also expect these records from senders, so missing ones can push your own emails into spam.

Is this check safe?

Yes. It only reads public DNS records that anyone on the internet can look up. The lookups run in your browser through Cloudflare’s public DNS service (Google Public DNS as a backup). If the domain publishes a BIMI logo, your browser shows it straight from the address in that record. Stetera Technologies doesn’t see or store the domain you type. More in our privacy policy.