How this check works
Scanner version 0.1.0-preview · methodology 2026-08-08 · last revised 2026-08-08.
Can They Email As Me? reads publicly published DNS, TLS and mail-transport records for a domain and explains what they mean for email impersonation risk. It cannot inspect your mailbox, administrator roles, multi-factor authentication, endpoint protection, backups, internal configuration or human processes — a clean result is not a claim that a domain or organisation is "secure."
| Test | Plain-English output |
|---|---|
| Nameserver / SOA | Informational resilience/configuration observations, with provider applicability. |
| SPF presence and syntax | Present, absent, invalid, lookup-risk or review. |
| DKIM | Detected, not detected, or unknown — never "absent" unless proven. |
| DMARC | Absent, monitor, partial enforcement or enforcement. |
| BIMI readiness | Eligible prerequisite, not eligible, detected or unknown; never implies logo issuance. |
| HTTPS/certificate | Healthy, expiring, invalid or unavailable. |
| DNS (DNSSEC/CAA) | Configured, missing or unknown. |
| MTA-STS/TLS-RPT | Configured, missing or invalid. |
| MX / mail provider | Healthy resolution, configuration issue or informational. |
| SMTP | Pass, problem, unknown or platform-specific not-applicable. |
| Relay behaviour | Tested, not tested or not applicable; never infers an open relay from provider-expected behaviour. |
| Web headers | Informational exposure only; CDN identity is not automatically a warning. |
| Reverse DNS | Evaluated for mail-server IPs; proxied web/CDN IPs are not penalised for missing PTR. |
| Blocklists | Listed, not listed, unknown or not checked; provider-blocked queries are unknown, not warnings. |
Limitations
- Unknown results are shown as unknown — they never silently become a failure.
- DKIM selectors cannot be exhaustively enumerated, so a missing selector is reported as unknown or low-confidence, not "no DKIM."
- A first public check never recommends moving straight to DMARC enforcement (
p=reject). - This tool does not perform a complete mailbox or security audit.
Correction and suppression
If a result is inaccurate, or you would like a domain's result suppressed, contact Suburban Secure and reference the result link. This page will link to a dedicated correction/suppression form in a future update.