Email Spoofing & BEC Check – SPF, DKIM and DMARC Scan

Business email compromise accounts for roughly a third of all cyber-insurance claims. It usually starts with a domain that anyone can forge.

The Email Spoofing & BEC Check tests whether a criminal could send email that appears to come from your business — to your customers, your bookkeeper, or your bank. Dedicated DMARC platforms charge $20–$45 every month for this. This is a single purchase and a report that tells you exactly what record to publish.

What it checks

• SPF — whether your domain declares who is allowed to send as you, and whether the policy is actually enforced
• DKIM — whether your outgoing mail is cryptographically signed
• DMARC — whether spoofed mail is rejected, quarantined, or silently allowed through
• MX and mail routing configuration
• Whether your mail server behaves as an open relay, tested safely without ever sending a message
• Configuration gaps that make your domain an easy candidate for invoice fraud

What you get

• A written PDF report emailed back to you, typically within one business day.
• Every finding rated Critical / High / Medium / Low.
• The exact DNS records to publish, written out so you can hand them to your registrar or IT provider.
• An executive summary that explains the fraud risk in business terms.
• A "what was checked" appendix that states the limits of the scan honestly.
• Reporting built to CompTIA Security+ and PenTest+ practice standards.

Who it's for

Any business that sends email from its own domain and invoices customers. If someone impersonating you could get a client to pay the wrong account, run this.

Requirements

• Windows 10 or Windows 11
• Run as administrator
• An internet connection
• The domain name you want checked
• About 5 minutes

What this is not

QuickScan is detection and advisory only. It never sends a spoofed message, never delivers mail to anyone, never exploits a weakness, and changes nothing on your systems. It is not a certification, an audit or an attestation.

One-time purchase. No subscription, no auto-renewal. Your report is prepared with AI-assisted analysis under ThreatVector's security review protocols and checked against our false-positive triage rules before it is sent. Reports are produced by ThreatVector LLC. ThreatVector and its scan library are developed, sold and distributed by ThreatVector LLC.