Purlock
Free tool · Email spoofing checker

Can someone send email pretending to be you?

If your domain isn't protected, anyone can send email that says it's from you, and many inboxes will accept it. We read your records and give you a straight answer, with exactly what to change.

Try:

Free, with no account needed.

What it checks

What you get from the email spoofing checker

  • A straight answer

    Protected, partly protected or exposed, in plain words.

  • DMARC

    Whether fake email gets rejected, sent to spam, or just delivered.

  • SPF

    Whether your domain lists who may send, and turns others away.

  • Subdomains

    billing.yourshop.com can be faked even when yourshop.com can't.

  • DKIM

    Whether your email is signed, using the common key names.

  • Domains that don't send

    How to lock a domain you never send email from.

For developers

Three lines from your own code

Every tool is also an API, with one simple answer format. Keep your key on your server.

JavaScript

const res = await fetch("https://www.purlock.com/v1/tools/email-spoofing-checker?target=example.com", {
  headers: { authorization: `Bearer ${process.env.PURLOCK_API_KEY}` },
});
const report = await res.json();

Prompt for Cursor or Lovable

Add a call to the Purlock Email spoofing checker API on the server side of this app. Send GET https://www.purlock.com/v1/tools/email-spoofing-checker?target=VALUE with the header "Authorization: Bearer" and the PURLOCK_API_KEY environment variable. The JSON answer has status ("good", "attention" or "bad"), headline, checks (each with level, title, detail, fix) and data. If the call fails or times out after 3 seconds, carry on as if it wasn't there. Never put the API key in client code.

Free plan: 100 calls a month. Individual: 5,000. Business: 25,000.

FAQ

Questions, answered

What is email spoofing?
Sending email with a fake From address, so it looks like it came from you. It's how many fake invoices and phishing emails work, and it needs no access to your account.
How do I stop it?
Set up SPF and DKIM, then add a DMARC record and move it from p=none up to p=reject once your reports look clean. Going straight to reject can block your own email if a service isn't set up, so go step by step.
How is this different from the email deliverability checker?
That one is about your own email reaching inboxes. This one is about stopping other people pretending to be you.

More free tools

Use it from your own code

Get a free API key with 100 calls a month. No card needed.

Get your API key