Domain check · 5 seconds
Could someone send email
pretending to be your firm?
The Law Firm Email Security Check reads what your domain tells the world about who may send mail as you, and scores it. Then, if you like, it watches a real message from your mailbox arrive and tells you how a receiving server judged it.
Completion-statement fraud starts with an email that looks like it came from you. Whether that is possible comes down to a handful of DNS records that most firms have never looked at.
What it covers
Five areas,
weighted by what stops a forgery.
SPF and DKIM let a receiver tell a genuine message from a forged one. DMARC is the instruction to act on that. Without DMARC at quarantine or reject, the first two are advisory. The weights follow that logic.
SPF
Which servers are allowed to send mail for the domain, whether the record is valid, and what a receiver is told to do with everyone else.
DKIM
Whether outgoing mail is cryptographically signed. We probe the selectors the common platforms use; the live test shows the one actually in play.
DMARC
The policy that tells the world what to do with a message that fails the checks — none, quarantine or reject — and whether anyone receives the reports.
Transport security
MTA-STS and TLS reporting: whether other servers are required to use encryption when delivering to you, and whether you hear when they cannot.
Receiving setup
Where the domain’s mail is delivered, whether those hosts exist, and whether the sending rules match the provider.
The check reads public DNS and, if you run the live test, the headers of one message. It is not an audit of your mail platform, your filtering service or your users' habits. A firm can score well here and still lose money to a convincing phone call; theAI Threat Check covers that side.
Questions
What people ask
before they run it.
What is email spoofing, and why is it a problem for law firms?
Spoofing is sending an email with a forged From address. Without SPF, DKIM and a DMARC policy set to quarantine or reject, anyone can send a message that appears to come from a partner or the accounts team, and most receiving systems will deliver it. For law firms the classic result is completion-statement fraud: a client receives changed bank details from what looks like the firm’s own address.
What do SPF, DKIM and DMARC actually do?
SPF is a DNS record listing the servers allowed to send mail for your domain. DKIM adds a cryptographic signature to each message so a receiver can verify it was not altered or forged. DMARC is the policy that tells receivers what to do when a message fails those checks, and where to send reports about it. All three are needed; DMARC set to reject is the one that actually stops forgeries.
What does the live send test show that DNS does not?
DNS shows what your domain declares. The live test shows what a receiving server concluded about a real message from your mailbox: whether SPF, DKIM and DMARC actually passed, which DKIM selector signed it, whether the checks align with your From address, whether it was encrypted in transit, and the route it took, including any filtering service in the path that SPF may not mention.
What happens to the test email I send?
It arrives in a mailbox that exists only for this purpose. We read the routing and authentication headers, keep those together with the sending address so we can show you the result and, if you ask, email you the report. The message itself is deleted. We do not read or keep anything in the subject or body.
My DMARC policy is p=none. Is that a problem?
It is the most common finding on UK law firm domains. p=none means the record exists but asks receivers to do nothing with forged mail, so it is delivered as normal. It is a legitimate monitoring stage while you collect reports and fix legitimate senders, but firms tend to stay there for years. The move to quarantine and then reject is what makes DMARC protective.
Can I fix these myself?
The DNS records are text records at your domain registrar or DNS host, and every finding on the result page includes the record to publish. Microsoft 365 and Google Workspace both document SPF and DKIM setup for their platforms. The judgement calls, such as when to move DMARC to reject and which third-party services need adding to SPF, are where an IT provider earns its keep.
The wider picture
Email is one door.
The IT Health Check walks round the building.
Identity, devices, backups, offboarding, the helpdesk. Thirty questions in ten minutes, answered without your IT provider in the room.
Take the IT Health Check →