Two questions decide whether someone can impersonate your company by email: can they send mail as you, and have they already registered a lookalike of your domain? Check both below — from public DNS, in a few seconds.
Enter your domain. We read its public mail-authentication records and sample the most likely lookalike names to see which are already registered. Public DNS only — we never connect to your site or to any lookalike.
Best-effort from public DNS as of the moment you run it. A clean result is not a guarantee, and absence of a record can mean a slow resolver rather than a missing one. When in doubt, verify with your mail provider.
SPF, DKIM and DMARC are the three public records that tell the world’s mail servers which messages are really from you. The one that matters most is your DMARC policy: p=none is published but toothless, while p=reject actually turns spoofed mail away. The scan grades where you stand.
Before a business-email-compromise attack sends the fake invoice, someone registers the domain it comes from — a typo of your name, a swapped character, an extra word like -support, or the same name on another TLD. The scan samples the most likely of these and shows you which already resolve.
What you just ran is a one-time sample. The real exposure moves: a lookalike registered next week, a DMARC record quietly weakened in a migration, a parked typo that suddenly starts sending mail. XIBA watches the full permutation space of your domain and your mail-authentication posture continuously, and routes an alert to your team — Teams, Slack or email — the moment something changes. It’s the same check you just ran, run for you, forever.