You can read your SPF, DKIM and DMARC records and conclude that nobody can forge mail from your domain. Records are a statement of intent. Whether they are enforced depends on your own mail platform's configuration, on rules somebody added years ago, and on how the receiving side interprets what you published.
The only way to know is to send a forged message and watch what happens.
What the check does
It delivers an actual message claiming to be from the domain under test, and reports what the receiving server did with it. Not an inference from your DNS — a real delivery attempt with a real answer.
This is why the check requires proven ownership of the asset first: a DNS TXT record, a file at /.well-known/, a code emailed to an address at the domain, a callback from the IP, or reverse DNS. Sending forged mail at a domain is not something anyone should be able to point at a stranger. It costs two credits.
Why a refusal is not automatically a pass
This is the part worth understanding, because it is where most tools quietly overstate their result.
A forged message can be refused for reasons that have nothing to do with your authentication. Greylisting. Rate limiting. An IP reputation rule. A full mailbox. Each produces a rejection, and a tool that only checks was it delivered? records all of them as a pass — telling you that spoofing is blocked when in fact your defences were never exercised.
When the refusal does not demonstrate that authentication did the work, ClickScan reports the result as inconclusive. Not a pass, not a failure. That is less satisfying than a green tick, and it is the honest answer.
What a real failure looks like
If the message lands in the inbox, anyone can send mail as your domain. That is the mechanism behind invoice fraud and most business email compromise: not a hacked mailbox, just a convincing From: address on a message about changed bank details.
The fix is in the email authentication records — usually DMARC still on p=none.
What you get
A grade, what the receiving server did, and whether that outcome actually proves anything. Run it after you change a DMARC policy: it is the difference between believing the change worked and knowing it did.
Every new account gets free starter credits. Start at app.clickscan.ai, or see everything ClickScan checks.