PentestMe checks whether someone can send mail that looks like it came from your domain, and whether your mail infrastructure will carry it. Every finding comes with the exact DNS record or setting that closes it.
Domain spoofing is the cheapest attack there is, and most domains are still open to it.
The assessment starts at DNS, resolving and evaluating your SPF, DKIM and DMARC records as a receiving mail server would, then moves to the mail infrastructure itself: which hosts accept mail for the domain, what they advertise, whether transport encryption is offered and enforced, and whether anything will relay mail it has no business relaying.
The gaps that let an attacker send convincing mail as you, or read what should have been encrypted.
No SPF record at all, or one ending in a soft fail that tells receivers to accept the mail anyway, plus lookup limits that silently break evaluation.
Mail leaving unsigned, selectors published with weak keys, or signatures that do not survive normal handling.
A DMARC record parked on p=none long after monitoring should have ended, so spoofed mail is observed and then delivered anyway.
Mail hosts that accept and forward mail for domains they do not serve, and submission endpoints reachable without authentication.
Missing or optional STARTTLS, expired certificates, and legacy protocol versions that allow a downgrade in transit.
Whether a message claiming to be from your executives reaches an inbox, and the mailbox rules that hide a compromise once it happens.
Email findings are unusual in that most of them are fixed with a DNS change and a short verification window. The report gives you the record to publish, the order to publish it in, and how to move DMARC from monitoring to enforcement without losing legitimate mail. Where a finding depends on how a receiving server behaves, we say what we observed rather than asserting a universal result.
Check your own domain for spoofing and relay exposure before you pay anything. No credit card.
Start your free pentest