Stop email that falsely claims to come from your domain.

A free check shows what your domain's email records allow. For £39 a month plus VAT, we take it to an enforcing DMARC policy one checked step at a time, then keep watch.

Start Free check

How it works

Check: enter your domain and an email address, and we send you a free report on its DMARC, SPF and DKIM records, in plain English.
Fix: you or your IT provider add two or three DNS records we send. We read the reports that email providers send about your domain and tell you when it is safe to tighten the policy, aiming for an enforcing policy within 30 days.
Watch: a short weekly report, and an alert the day we see a new sender using your domain, a record go missing or the next step become ready.

Free check

Enter your domain and an email address, and we will send you a free report on what your domain's email records allow, in plain English. We send the report to that address and nothing more unless you ask.

One plan, priced per domain

£39 / month · £390 / year

The DNS records to add, written out in full, with a note for your IT provider
Every DMARC report sent about your domain, read for you
A step-by-step move to p=reject, each step only once your own email passes
A short weekly report in plain English
An alert the day we see a new sender, a missing record or a step that is ready

Prices are per domain and exclude VAT. No setup fee and no minimum term: cancel any time and you will not be charged again.

Start

Questions

Why did you email us?: We look up the public DNS records of email domains belonging to companies on the Companies House register, and write once to tell each company what we found. We use the general enquiries address published on the company's own website, send one follow-up at most, and never write again if you reply "unsubscribe". Our privacy notice explains what we hold, and our contact check page explains how we found your address.
What is DMARC?: A short public record in your domain's DNS. It tells mail servers that receive a message claiming to be from your domain what to do if the message fails two checks: SPF, a list of the servers allowed to send your email, and DKIM, a signature your email system adds to each message. A message passes if either check passes for your domain. The policy is p=none (take no action), p=quarantine (send it to junk) or p=reject (refuse it). The National Cyber Security Centre recommends DMARC.
Will it stop our own email arriving?: Not if it is done in steps, which is how we do it. We start at p=none, which changes nothing about delivery and turns on the daily reports. The reports show the systems sending email as your domain, such as your mailbox provider, practice software or a newsletter tool. We recommend p=quarantine, and then p=reject, only once all of them pass, and if one does not, we tell you which. The remaining risk is a system that sends so rarely that it does not appear in the reports before a step. If that happens, change the record back and tell us: any step can be undone by changing one line.
What does our IT provider need to do?: Add two or three DNS records at the start, which takes a few minutes for whoever manages your domain, and change one line of the DMARC record at each later step, usually twice. We send the exact records with a note they can act on without contacting us. We never need a password or access to your systems, and we never change your DNS ourselves.
We use Microsoft 365 or Google Workspace. Does that matter?: Both work well with DMARC. Each needs DKIM switched on for your own domain, once. Until it is, Microsoft 365 signs your email with its own onmicrosoft.com name, which does not count for your domain. Your SPF record also needs to name your provider. We send the exact steps for Microsoft 365 and Google Workspace, and tell you what to ask for if you use another provider.
What does it not protect against?: At p=reject, DMARC tells receiving servers to refuse email that uses your exact domain without passing the checks. It does not stop a lookalike domain, such as one with a letter changed, and it does not help if someone gets into one of your mailboxes. The Solicitors Regulation Authority's cybersecurity guidance says email modification fraud is the most common cyber incident reported to it, at 68 percent of reports, and its own example is a firm whose name was copied with the letter O replaced by a zero. For those routes, the defences are staff checks on any change of payment details and two-step sign-in on every mailbox.
How does billing work?: You pay by card through Paddle, our reseller and Merchant of Record. Paddle takes the payment, charges VAT and sends your VAT invoice, and the charge appears on your statement as PADDLE.NET* SPOOFMARK. The price is £39 a month or £390 a year for each domain, plus VAT, with no setup fee and no minimum term. You can cancel at any time and you will not be charged again. If you ask within 14 days of a payment, you get it back in full.
Who is behind Spoofmark?: Spoofmark is a trading name of Averlane Systems Ltd, a company registered in England and Wales, number 17556191. The service is automated and works by email. We will never phone you, and we will never ask for a password or for access to your systems. If anyone does either in our name, it is not us. You can reach us at hello@spoofmark.com.