1
Drop the files
The .zip or .gz attachments from your report emails. As many as you like.
Do it yourself
Everything here runs in your browser. Your files never leave your computer, and you can use it all forever, whether or not you ever hire us.
Tool one
Every day, Gmail, Outlook and the rest send your domain a report of every server that sent email using your name. They come as zip files of raw data, which is why almost nobody opens them. This turns them into plain English.
1
The .zip or .gz attachments from your report emails. As many as you like.
2
One card: did anything using your name get into an inbox without passing the checks.
3
Those are your own services. You need that list before you tighten anything.
Nothing is uploaded. The files are opened on this computer.
The easy one: run the free check, press Get My Free Dashboard, and show the domain is yours. Your dashboard gives you a report address of its own, you paste one line into your DNS, and from then on it reads the reports for you every day. Nothing to drop here.
The by-hand one: put this line in your DNS, with an address you already read in place of the example. Reports start the next day, and you drop them here.
p=none changes nothing about how your email is delivered. It only turns the reports on.
What to look for
Google, Microsoft, your invoicing tool, your newsletter. Write the list down.
Not an attack: that service isn't set up to sign your mail yet. Fix it before you tighten, or its mail starts bouncing.
This is the one that counts. Delivered means people read it. Spam or refused means the rule did its job.
One failure from an unknown server is noise, often forwarded mail. The same one day after day, in volume, is somebody working.
Reports show servers and counts, never what a message said or who received it, and only providers that send reports are covered, which is most of the big ones.
Tool two
The same check that runs on the front page: about 240 versions of your name, which of them are taken, and what each one has on it.
If it came from your own account
If the message really was sent from your mailbox, nobody faked your address: somebody is using your account. That needs a different response, today. In this order:
For everyone, not just the affected account. This ends their access first; everything below is clean-up.
Especially forwarding or auto-delete. This is the invoice-fraud move: it hides the replies from the real owner.
In Google Workspace or Microsoft 365, the list of applications with access to the mailbox.
Locations and devices nobody recognises tell you how long it's been going on.
Using numbers you already have. Not by email, and not a number from an email. If money has moved, your bank the same day, and a report at ic3.gov.
We watch and we tell you. We aren't incident responders, and we'll say so rather than take money for something outside what we do.
Guide
People calling you back angry about calls you never made means your number is being spoofed: someone put it on their caller ID. There's nothing to scan. Phone networks keep no public record of who did it, so no tool can show you or undo it. Four things do something:
The step with teeth: spoofing a number to defraud carries penalties of up to $10,000 per call. Choose Phone, then unwanted calls, then your own number being spoofed. Note dates, times and what the callbacks said before you file.
Some voicemail systems let anyone calling from your own number straight in. Then ask your carrier for their free call-blocking and number-protection tools; every major US carrier has them, usually in their app.
Don't argue. My number is being spoofed by a scammer. I didn't call you, I'm sorry you got that call, and you can report it to the FCC. Let unknown numbers go to voicemail.
The Do Not Call Registry stops legitimate telemarketing, which makes the spoofing pattern easier to see. A call-screening app that labels likely spam helps most for a business number.
Spoofing is only illegal when it's meant to defraud or cause harm, which is why the complaint is the lever rather than a switch: it builds the case that gets numbers cut off, even when nothing seems to happen the same day.
There isn't one. The check, the plan, the dashboard and these tools are free and stay free.
They tell you the truth at the moment you look. They can't see fake social profiles (those go to each platform), and for phone numbers they can point you at the right action but can't scan a network that keeps no record.
Doing the work for you: the records set and tightened in the right order, the notices sent, a short note each week, and an email the morning after our nightly check finds a new look-alike that could pass for you.