Can someone fake an email from your firm?
Type your firm’s domain — the part after the @ in your email address. In a few seconds you will see whether Gmail, Outlook and other mail systems are told to stop email that pretends to come from you, in plain words, with what to ask your IT person to change.
What this checks, in plain words
Anyone can put your firm’s address in the “From” line of an email. Three published settings decide whether your clients’ mail systems believe it.
The sender list (SPF)
A list of the services allowed to send email as your firm — Microsoft 365, your payroll service, your e-signature tool. On its own it does not stop a fake: it only says who is on the list.
The signing keys (DKIM)
Real email from your firm carries a signature a receiving system can check. The checker looks for keys under the names Microsoft 365, Google Workspace, Zoho, Brevo, Mailchimp, Constant Contact, iCloud, Proton and the other common sending services use. A key under another name is not seen, so “not found” here is never a finding against your firm.
The blocking rule (DMARC)
This is the one that matters. It tells Gmail, Outlook and the rest what to do with an email that claims to be from you and fails the first two checks: deliver it anyway (“none”), send it to junk (“quarantine”), or refuse it (“reject”). Only quarantine or reject, on all of your mail, stops a fake. A record set to “none” looks like protection on most scanning tools and blocks nothing.
Why a tax firm should care
The scam is simple. A client gets an email that looks like it came from you: a new bank account for their refund, a link to “upload your documents”, an invoice to pay. The IRS Security Summit has warned tax professionals about exactly this kind of email (IR-2025-75). The FTC Safeguards Rule asks every tax preparer to have a written security plan that covers the risks it can reasonably foresee, and email pretending to be the firm is one of the most foreseeable there is.
Questions
What does this checker look at?
Three public settings on your firm's domain: the sender list (SPF), the blocking rule (DMARC) and the signing keys (DKIM), plus who receives your email. They are published records anyone can look up. Nothing is sent to your firm and nothing connects to your mail server.
My result says "Reports only - blocks nothing". Is that bad?
It means a DMARC record exists, but it is set to "none", which only collects reports. A fake email from your address is still delivered. Most scanning tools show this as protected. It is not. In the study, 45% of small tax firms that had DMARC left it on "none".
Do you keep the domain I type?
No. The domain is looked up in public DNS records and the answer is shown to you. It is not stored and it is not added to any list.
Who can fix it?
Whoever manages your email: often your IT provider, or your Microsoft 365 or Google Workspace administrator. The changes are settings in your domain's DNS, and the result tells you exactly which one to ask for.
Does the FTC Safeguards Rule require DMARC?
The rule does not name DMARC. It requires a written security plan that addresses the risks a firm can reasonably foresee, and email that impersonates the firm is one the IRS has warned tax professionals about for years.