Without email authentication, anyone can send a booking confirmation or deposit request that looks like it came from your front desk. NotSpammy checks your domain from the outside and shows exactly how spoofable it is today — then hands you the fixes, in plain language.
A side-by-side of two identical booking confirmations from reservations@yourhotel.com: on the left, the message the property really sent — authenticated by SPF, DKIM and DMARC, with an intact seal; on the right, an identical message a stranger sent as the property — a forgery, with DMARC set to none and no valid signature. Only email authentication tells a genuine message from a forgery.
Your guest sees the same sender on both. Only email authentication tells a genuine message from a forgery.
The same public records a mailbox provider reads before it can trust that a message is really from you — checked from the outside, exactly as an attacker would probe them.
Guests already trust mail that carries your name. Without proper authentication, that trust is the attack — and hospitality is a favourite target.
A guest gets a confirmation that appears to be from your property, with a link to “verify” their card. It never reaches your PMS — but the chargeback and the angry review reach you.
Exposure on file“Our bank details have changed — please re-send the deposit here.” Sent from a lookalike of your own address, it is one of the costliest scams in hospitality.
Exposure on fileReception and reservations get mail that looks internal, harvesting logins and PMS access. Strong authentication makes your domain far harder to imitate.
Exposure on fileNo connection, no login, no access to your inbox — just the public records, read the way an attacker would probe them.
No connection, no login, no password. NotSpammy only reads records that are already public.
A passive, external check of the very records a mailbox provider reads before it trusts a message.
A prioritized, plain-language list of gaps with the exact DNS records — plus alerts when something drifts.
Each is explained in a single line — no jargon, no access to your systems. We read them the way a mailbox provider does, then hand you a fix for whoever manages your DNS.
Every scan sums to one clear standing: how hard it is for someone to spoof your domain, based only on what is publicly observable. Your score reflects the strength of your public email authentication — SPF, DKIM and DMARC.
Bands describe spoofability, not a delivery outcome.
Spoofability runs on a 0 to 100 clearance scale, from most exposed to most protected. Score 0 to 49 reads as Spoofable — core protection is missing. Score 50 to 79 reads as Partially exposed — gaps a spoofer could use. Score 80 to 100 reads as Protected — hard for anyone to send as you.
Core protection is missing.
Gaps a spoofer could use.
Hard for anyone to send as you.
See your exposure at no cost. Upgrade when you want the full report and continuous drift alerts.
1 domain, weekly checks, drift alerts the moment protection slips.
Get started3 domains, daily checks, Slack alerts, CSV export for your team.
Get startedCheckout runs in Stripe test mode until launch — no card is charged. 14-day refund on one-time reports. Annual billing saves two months.
Run the free lite scan. No account, no access to your inbox — just your first honest result and the fixes that matter most.