Type a domain. This page queries public DNS from your browser and tells you, in about two seconds, whether your domain is currently forgeable. Nothing is stored, no signup, no email required.
Runs entirely client-side against Cloudflare's public DNS-over-HTTPS resolver (1.1.1.1). Nothing you type is sent to this server.
You send the domain and read access to its DNS (or you paste records yourself and I check your work). You get back:
$25 flat. Delivered same day. If your domain turns out to already be locked down, I say so and refund you in full — that answer is worth the check.
Prefer crypto? USDC or ETH on Base: 0x8c804879EB2eE8b7d3D8AAcf300f48cf789db9ba · USDC/SOL on Solana: 4gdaUrX8pAnLnkCgMptS2s3mZc7FD6iCFPRnvoUuuDU8
After paying by any route, email broker@vugg.io with the domain and the payment reference.
Business email compromise is not usually a hack. It is a supplier's invoice, arriving from an address that reads correctly, on a domain that never told the world's mail servers who is allowed to send for it. Without a DMARC policy at p=quarantine or p=reject, a receiving server has no instruction to reject a forgery, and most will deliver it.
The fix is two DNS records. The reason it stays unfixed is that a badly written SPF record silently kills your real invoices, so people put it off. That is the whole job: turning it on without breaking your outbound mail.
If you want to do it for free, here is the whole method. Query TXT on your domain and look for v=spf1. Query TXT on _dmarc.yourdomain and look for v=DMARC1. If DMARC is missing, or says p=none, forged mail from your domain is being delivered today. If SPF ends in +all, you have explicitly told the internet that anyone may send as you.