Can I check email spoofing risk without sending test mail?

Yes. RedScore reads your public DNS records for DMARC, SPF, and DKIM. That is enough to spot most spoofing gaps before an attacker tries.

Does a DMARC policy of p=none mean my domain is safe?

No. p=none is monitoring mode. Spoofed mail can still reach inboxes. Move to p=quarantine or p=reject when you are ready.

Which domain should I scan?

The domain in your From address. If you send mail as hello@yourcompany.com, scan yourcompany.com.

Will fixing email auth stop all phishing?

No. It stops many spoofing attempts on your domain. You still need user training and other controls for lookalike domains.

How to check if your domain can be spoofed

How do I check if my domain can be spoofed?

Start with your public email authentication records. If DMARC is missing or set to monitoring only, if SPF is too loose, or if DKIM is not published, attackers can send mail that looks like it came from your company.

You do not need to send test messages or log into your mail provider dashboard to spot the obvious gaps. RedScore reads what anyone on the internet can see.

Go to /lookup and enter the domain you send mail from. The report flags email auth failures and ranks what to fix first. See the DMARC checker, SPF checker, and DKIM checker pages for what each outside-in pass covers.

What email auth records matter most?

DMARC tells receiving mail servers what to do when SPF or DKIM fail. A policy of p=none means monitor only. Spoofed mail can still land in inboxes.

SPF lists which servers may send mail for your domain. A record that ends in +all or includes too many senders makes spoofing easier.

DKIM adds a cryptographic signature to outgoing mail. Without it, receivers have less proof the message really came from you.

Fix DMARC enforcement first once SPF and DKIM are aligned. That is the step that actually blocks spoofed mail.

What does RedScore check from the outside?

RedScore runs a passive scan of public DNS and mail auth signals on your domain. It checks whether DMARC, SPF, and DKIM are present, whether the DMARC policy is enforced, and whether common misconfigurations show up.

It does not read your mail server logs, your Google Workspace admin panel, or your SendGrid dashboard. It checks what buyers and attackers can already look up in DNS.

What should I fix first?

Publish a DMARC record if one is missing.
Move from p=none to p=quarantine or p=reject once SPF and DKIM pass.
Tighten SPF so only your real mail providers are listed.
Enable DKIM signing with your mail provider and publish the public key in DNS.
Rescan from /lookup after DNS changes propagate.

Most DNS changes take a few minutes to a few hours. Give it time, then rescan to confirm the grade moved.

What is this not?

This is not a phishing simulation. It is not a review of your mail server configuration behind the firewall. It is the public check that tells you whether your domain is an easy spoofing target before a customer or attacker finds out.