Anyone can email your customers using your name.
Until you publish one DNS record, nothing tells Gmail or Outlook to refuse a forgery. Publishing it takes about 10 minutes and blocks nothing on day one — it just shows you who is already sending as you.
Five questions, no email address required.
Tick what applies. Each one changes how exposed you are — and none of them is about how technical you are.
Tick anything that sounds like you.
Most small businesses match at least 3 — usually the ones about extra sending tools and having nobody watching the domain.
Check your domain insteadBusiness email fraud cost US victims about $2.95 billion in one year.
FBI IC3 2023 Internet Crime ReportThree things, one of them in your registrar.
This is the whole job. The only unfamiliar part is pasting a record where your domain lives, so here is exactly what that screen looks like at the common registrars.
Add your domain
Type it in. We generate the exact record for you — there is nothing to configure and no options to get wrong.
Paste one record
Log in wherever you bought your domain and add a single TXT record. We show you the screen and the field names for your provider.
Read your first report
Providers begin sending reports the next day. We turn them into a plain list of who is sending as you, named and grouped.
Where is my domain hosted?
DNS → Records → Add record. Cloudflare calls the value field "Content", and leaves TTL on Auto.
Leave the orange proxy cloud alone — it does not apply to TXT records.
Most small businesses never need to pay us.
If you have up to 2 domains, the free plan is the whole product. We would rather you stayed on it than churned off a trial.
2 domains, 30 days of report retention, and every protocol check the paid plans run.
5 domains, 365 days of report retention, and the detail you need once you start enforcing.
Free plan: 2 domains, no card, no expiry · Trial: card required, billed on day 15 unless you cancel · 14-day money-back on new paid plans
The email your business depends on.
Order and refund emails
Confirmations and shipping notices are the easiest messages to clone convincingly, because customers are already expecting them.
Invoices and engagement letters
A forged invoice from an accountant or law firm is paid without question. Authentication is what makes the real one provable.
Anything signed by a founder
A short request from the CEO to finance is the oldest attack in the book, and it works because the domain looks right.
Bookings and review requests
Appointment confirmations carry links and card details, which makes them worth impersonating and easy to misuse.
The worries that stop people starting.
Not at the setting we start you on. p=none means "watch and report, change nothing" — receiving servers treat your mail exactly as they did yesterday. You only move to a blocking policy later, deliberately, once your reports show every legitimate sender is authenticated. That is the step where care is needed, and the product holds you back from it until the numbers support it.
Find out who is sending as you.
Thirty seconds and no signup for the check. Ten minutes and one DNS record for the monitoring — and the first report lands the next day.
What buyers on this page ask.
Other solutions, comparisons and pricing. The product is the same on all of them — what changes is who has to approve it.