Spoofhound tools

Website security scanner

Scan any website's HTTPS, security headers, CSP, cookies, exposed files, DNSSEC, CAA and security.txt — graded out of 100.

Scan a website →

HTTP security header check

See a site's live HTTP response headers and a plain-English assessment of the security-relevant ones — HSTS, CSP, clickjacking, cross-origin isolation and more.

Check headers →

Domain spoofing & branding check

Score any domain's SPF, DKIM, DMARC, MTA-STS, TLS-RPT, BIMI, VMC and logo setup out of 100, with exactly what's missing and why it matters.

Check a domain →

Email send test

Test an SMTP server or a sending API (SES, Oracle Email Delivery, SendGrid, Mailgun, Postmark, Brevo) with a live, streamed conversation and a clear pass/fail result.

Run a test →

Inbox test

Get a one-time address, send it a test email, and see its SPF, DKIM, DMARC, BIMI, MTA-STS and TLS-RPT status plus a Spoofhound deliverability score.

Get a test address →

DMARC record check

Analyse a DMARC record against DMARCbis: every tag explained, deprecated tags flagged, policy gaps called out, and external report destinations verified.

Check a record →

SPF record check

Walk a domain's whole SPF include chain: how many of RFC 7208's ten DNS lookups it uses, which terms resolve to nothing, and anything that makes receivers return permerror.

Check a record →

Email header analyser

Drop in an email and read what the receiving server worked out: SPF, DKIM and DMARC results, alignment, every hop it took, and anything suspicious. Never leaves your browser.

Analyse an email →

DNS lookup

Look up any A, AAAA, CNAME, MX, TXT, NS, SOA, SRV, CAA, DS or TLSA record and see exactly what it resolves to right now.

One click also finds the email records whose names are easy to get wrong — SPF, DMARC, DKIM, BIMI, MTA-STS, TLS-RPT and TLSA for DANE. Those do not live at the domain, so the tool works out where to look: DKIM across the common selectors, and TLSA at every host your MX points at.

Look up a record →