Spoofing Risk Calculator
Estimate your exposure to spoofed-invoice and email fraud.
This is a rough, illustrative estimate of how much a spoofed-invoice or business email compromise (BEC) attack could cost you over a year, based on a few numbers you provide and published averages for this kind of fraud. It is a thinking aid, not a prediction. Nobody can tell you your exact exposure, and we will not pretend to. What the calculator does do is show, transparently, how the size of your organisation and the value of the payments flowing past your domain change the scale of the risk, and how reaching an enforced p=reject policy removes the cheapest version of that attack. Everything runs in your browser. Nothing you type is sent or stored.
The Spoofing Risk Calculator estimates how exposed your domain is to email fraud (forged invoices, fake supplier requests, and impersonation of your staff) by inspecting the authentication records that mailbox providers use to decide whether a message can be trusted. It looks up your published SPF, DKIM and DMARC records and weighs them together to produce a simple risk rating rather than a single pass or fail.
What it measures
The biggest single factor is your DMARC policy. A domain with no DMARC record, or one published as p=none, tells receivers to take no action on unauthenticated mail, so an attacker can forge your exact domain in the From: address and still reach inboxes. Moving to p=quarantine and then p=reject is what actually stops the spoof. The calculator also rewards a hard SPF fail (-all) over a soft fail (~all), and the presence of valid DKIM signing, because DMARC needs at least one of SPF or DKIM to align before it can authorise a message.
How to read and fix your result
A high-risk result almost always means your DMARC policy is missing or set to monitoring only. To reduce exposure:
- Publish a DMARC record and add a
ruaaddress so you can see who sends as you before tightening. - Once your legitimate senders pass, raise the policy from
nonetoquarantine, then toreject. - Tighten SPF to
-alland make sure every genuine sender is covered by SPF or DKIM.
Reaching reject safely takes care, which is the slow part most teams get stuck on. Our done-for-you enforcement handles the report analysis and staged rollout for you. You can also run the live free tools to check each record individually.
Frequently asked questions
What actually stops someone spoofing my exact domain?
A DMARC policy of p=quarantine or p=reject is the only control that tells receiving servers to refuse mail that fails authentication on your domain. SPF and DKIM alone do not block forged From: addresses without DMARC enforcement on top.
Why is a p=none DMARC record still rated as risky?
Because p=none only requests reports: it instructs receivers to deliver mail normally even when it fails SPF and DKIM. It is useful for monitoring, but it provides no protection against impersonation until you raise it to quarantine or reject.
Does having SPF and DKIM but no DMARC protect me?
Not against direct-domain spoofing. SPF and DKIM authenticate mail, but without a DMARC record there is no published policy telling receivers what to do when those checks fail, so a forged message can still be delivered.
What is a spoofed-invoice attack?
It is a form of business email compromise where a fraudster sends a payment request or amended bank details that appears to come from a trusted supplier or a senior colleague. If your domain can be spoofed, the message can carry your real domain in the From: address, making it far harder for staff to spot.
Can this calculator see my private email security settings?
No. It only reads the public DNS records (SPF, DKIM and DMARC) that any receiving mail server already queries to make a delivery decision. It does not access your mailboxes or internal systems.
My risk is high. What should I do first?
Publish a DMARC record with a rua reporting address so you can identify every legitimate sender, then move the policy from none to quarantine and finally reject once those senders pass. See how enforcement works.