Fake invoices and wire instructions
Business email compromise cost victims $2.77 billion in 2024, according to the FBI's Internet Crime Report. The usual trick is an email that looks like it came from someone the victim already trusts, like you.
Free email impersonation check
Can a scammer send email as your business? Find out in 10 seconds.
If your domain isn't locked, anyone can send an email that shows your business name and address: a fake invoice, or "new" wire instructions to your clients. The same gaps push your real emails into spam. We check it for free, then fix it for you.
Free. No signup. We only read public DNS records, the same ones every email server checks.
- Done for you in 48 hours
- Flat $297 per domain
- Pay only after it scores an A
?
See the technical details
Fix it yourself: the exact changes
Why this matters
Your real emails land in spam
Since 2024, Gmail and Yahoo require every sender to pass SPF or DKIM, and larger senders to publish DMARC. Microsoft added similar rules for Outlook.com in 2025. Quotes, invoices and reminders that fail these checks can be filtered or bounced.
Look-alike domains
Scammers also register domains one letter off from yours, like smithlavv.com for smithlaw.com. Our check tests the common variations and tells you if any of them can send email.
How it works
Free check
Ten seconds, right here. You see exactly what's open and why.
20-minute setup call
We turn on signing with your email provider and publish the right records with your domain host. Nothing changes without your OK, and we never ask for your passwords.
30-day safe rollout
We watch the reports so your invoices, newsletters and website forms keep working, then switch on full blocking.
Proof
You get a before-and-after report showing an A grade, and you can rerun this check any time to confirm it.
Simple pricing
Lockdown
$297 one-time, per domain
- SPF repaired and merged
- DKIM signing turned on (Google Workspace, Microsoft 365, Zoho and more)
- DMARC published, then moved to full blocking over 30 days
- Look-alike domain sweep
- Before-and-after report
- No payment until your domain scores an A on our check
Guard
$29 per month, per domain
- Weekly check that everything still passes
- Alert and fix within one business day if something breaks, like a new website or email tool
- Look-alike domain watch
- Plain-English monthly report
- Cancel any time
IT companies and web agencies
Partner pricing
- Protect every client domain under your brand
- Bulk checker for your whole client list
- We do the work, you keep the client
Pay after it works
You pay nothing up front. We do the setup with you, and you get the invoice when your domain scores an A on our check. There's nothing to argue about: the check reads public records, and anyone can run it.
Questions
What exactly do you change?
Up to three DNS records at your domain host (SPF, DKIM and DMARC) and one setting in your email admin console that turns on signing. We don't touch your website, your mailboxes or your passwords.
Do you need my passwords?
No. We do the setup on a screen-share while you stay logged in, or you add us as a temporary delegate on your domain account and remove us when we're done.
Will this break my email?
Not the way we do it. We start in monitor-only mode, use the reports to find every service that sends email for you (invoicing, CRM, newsletters, website forms), add them, and only then switch on blocking. If anything legitimate fails, we fix it the same business day.
I use Gmail or Microsoft 365. Isn't that enough?
Your provider protects your mailbox, not your domain. Whether strangers can send email pretending to be @yourbusiness.com is controlled by records at your domain host, and most businesses have never set them.
Does this stop all email fraud?
Nobody can honestly promise that. Lockdown stops scammers from sending email using your exact domain, and Guard warns you about look-alike domains. It can't protect a mailbox whose password gets stolen, so turn on two-step verification for every email account.
Who is behind SpoofShield?
SpoofShield is run by Tristin in Hallandale Beach, Florida. You deal with a real person, not a ticket queue.
What if I have more than one domain?
Every domain that sends email needs its own lock. Domains you own but don't use for email need a "no mail" lock too, because unused domains are easy to abuse. You can buy several at checkout.
When do I pay?
After your domain scores an A on our check. You get one invoice for Lockdown; Guard is billed monthly after that and you can cancel any time.
Is the free check safe?
Yes. It reads public DNS records, the information every email server in the world looks at. The lookups run in your browser through Cloudflare's and Google's public DNS services. We don't store the domains you check unless you send us the form.