· By Nicholas “Nick” O'Sullivan, Townsville
Can someone spoof email from my domain? Try our free domain check
Can They Email As Me? is now available in preview. It is a free tool that answers one practical question: could someone else send an email that looks like it came from your domain?
- Free to use during preview
- No account, email credentials or software installation required
- Reads public domain and mail-security records only
- Returns a result in plain English that you can share with your IT provider
Run the free domain spoofing check, then please let us know whether the result and guidance are useful.
Why is email spoofing possible?
Email’s underlying protocol, SMTP, does not verify the sender by default. The From address is a claim — much like the return address written on a paper envelope.
Receiving mail systems therefore look for additional evidence before trusting a message:
- Is the sending server authorised for this domain?
- Does the message carry a valid cryptographic signature?
- Has the domain owner told the receiver to quarantine or reject messages that fail those checks?
What helps stop someone emailing as your domain?
Three DNS-published email authentication standards work together:
- SPF lists the mail servers authorised to send on behalf of your domain.
- DKIM lets a receiver verify that a message carries a valid signature created by a service holding your domain’s private key.
- DMARC tells receivers what to do when a message fails authentication and where to send reports.
Publishing a DMARC record is not the same as enforcing it. A monitoring policy (p=none) collects evidence but does not ask receivers to block impersonated mail. Moving to quarantine or reject should be staged carefully, after confirming that every legitimate sending service is authenticated. Our methodology explains what the check can and cannot prove.
What does the free check look at?
The tool checks the public signals that receiving mail systems use, including:
- whether an SPF record is published;
- whether DKIM signing is detectable from public information;
- whether DMARC is published and set to monitor, quarantine or reject; and
- whether SPF and enforcing DMARC are working together to meaningfully resist direct domain spoofing.
DKIM detection is necessarily best-effort. Selectors usually cannot be discovered reliably without receiving a real email, so a public-only check may understate genuine DKIM adoption.
What are preview users’ domains telling us so far?
At 9 August 2026, 00:00 UTC, the de-identified research snapshot covered 13 distinct domains, counting each domain once using its most recent completed check:
- 77% published an SPF record — 10 of 13 domains.
- 62% published a DMARC record — 8 of 13 domains.
- 54% had DMARC set to enforce with quarantine or reject, rather than monitoring only.
- 0% had DKIM signing detectable through the tool’s best-effort public checks.
- 54% had both SPF and enforcing DMARC — the combination that meaningfully resists direct spoofing of the domain.
The snapshot refreshes every few hours and is not live.
These are early product-usage figures, not national cyber security statistics. The domains were voluntarily submitted by people using the tool; they are not a random or representative sample of Australian businesses, charities or other organisations. The figures describe this preview’s user base only.
Why did Suburban Secure build it?
This product grew from our work developing free cyber security check-ups for businesses, charities and not-for-profits. Those broader reviews repeatedly pointed back to a deceptively simple risk: an organisation’s real email may work perfectly while its domain still lacks the policy needed to stop an impersonator.
For a small business or community organisation, spoofed email can put more than the organisation at risk. It can be used to target:
- customers receiving false invoices or payment-detail changes;
- staff and volunteers receiving fake requests from leaders;
- suppliers being asked to disclose information or redirect goods; and
- community members who trust the organisation’s name.
A free cyber security resource for Townsville, Cairns and across Australia
Suburban Secure is based in Townsville and works with organisations across North Queensland and Australia. We built this as a practical resource that a business owner, charity treasurer, office manager or IT volunteer in Townsville, Cairns, regional Queensland or anywhere in Australia can use without booking a consultation.
Correct email authentication also supports the reputation of legitimate mail, but it does not guarantee inbox placement. Deliverability depends on many factors. The immediate goal here is narrower and important: help receivers distinguish email authorised by your organisation from a direct attempt to impersonate its domain.
Try the preview
Visit cantheyemailasme.com, enter your organisation’s domain and run the free check. If anything is unclear — or if the result does not give you a useful next step — please tell us. Preview feedback will help us make the explanations and guidance more useful for the businesses, charities and people this tool is intended to protect.
