Check whether your domain can be forged. It takes about two seconds, reads only records that are already public, and costs nothing.
No sign-up. No access to your systems. Nothing is stored.
Three public settings decide whether an inbox trusts a message claiming to be from you. SPF lists who may send as you. DKIM signs your mail so it cannot be altered in transit. DMARC is the one that tells inboxes what to do when a message fails those checks, and it is the one most organisations either do not have, or have set to do nothing at all.
This page reads SPF and DMARC live from public DNS, the same records an attacker looks at first. DKIM can only be confirmed with a sample of your actual mail, which is part of the paid check.
Why it matters more if you handle other people's money. Deposits, rent, completion funds, client account transfers and invoices all move on the strength of an email. A convincing "our bank details have changed" message, sent from what looks exactly like your own address, is the cheapest fraud there is.
The loss lands on your client. The conversation afterwards lands on you.
Everything in Check and fix, plus monthly monitoring: who is sending mail as you, any lookalike domains registered against your name, and one plain-English line on what changed.
The report, plus the changes made with your existing email and domain provider, plus a one-page sheet your staff can use to spot a payment-change scam.
A written report: whether someone can send email as you today, what each record says, and exactly what to change. Plus the lookalike domains already registered against your name, which no DMARC setting can stop. No access needed.
Fixed prices, no contract, and the monthly watch stops whenever you say so. Reports are delivered within one working day. Terms, privacy.
I work in financial-crime analysis. This is deliberately one narrow service: a single problem, checked properly, explained without acronyms.
Nothing is scanned, probed or logged into. Everything above comes from public DNS records that anyone in the world can read without asking permission.
The check runs in your own browser. No cookies, no analytics, no sign-up, and no record of the domain you typed. How that works, in full.