Use Case
Stop Phishing Attacks Using Your Domain
Check whether your domain can currently be used in phishing attacks against your customers and staff. VP Shield assesses your DMARC, SPF, DKIM, and spoofing exposure — free, no login.
Check phishing exposure →What's Checked
- Real-time phishing exposure assessment
- DMARC policy enforcement check
- SPF configuration review
- DKIM status detection
- Email spoofing risk rating
- From: header forgery test
- Subdomain phishing exposure
- Step-by-step enforcement roadmap
Common Questions
- Can someone really send phishing email using my domain?
- Yes, if you do not have DMARC enforcement. Without a DMARC policy of p=quarantine or p=reject, anyone can forge your domain in the From: address of emails and have them delivered to recipients. VP Shield shows your current exposure level immediately.
- How long does it take to prevent domain phishing?
- Adding SPF and a DMARC p=none policy takes about an hour. Moving to p=reject typically takes 4–8 weeks — you need to audit all your legitimate sending sources first to avoid blocking your own email. DKIM setup depends on your mail provider but most support it natively.
- Will DMARC enforcement stop all phishing?
- DMARC rejection stops phishing emails that spoof your exact domain from being delivered to properly configured mail servers. It does not prevent typosquat domains (variations of your domain name) — those require separate monitoring and domain registration. It also does not prevent attackers from compromising legitimate accounts.
Run a free domain security scan
VP Shield checks DNS, TLS, email authentication, security headers, and subdomain takeover risk for any domain. Free, no login, two minutes.
Related Services
Cyber Essentials Domain Audit
Preparing for Cyber Essentials or Cyber Essentials Plus certification? VP Shield checks the domain security controls that assessors look for — TLS, security headers, DNS hygiene, and more.
Run your pre-assessment scan →GDPR Email Security Check
UK GDPR requires appropriate technical security measures for personal data. Check whether your email infrastructure meets UK GDPR Article 32 requirements — DMARC, DKIM, SPF, and TLS — free.
Run GDPR email check →Domain Security for Remote-First Teams
Remote working expands your attack surface. Check whether your domain email authentication, TLS, and security headers are configured to protect a distributed workforce from phishing and MitM attacks.
Check remote-working security →