Can someone fake email from your business?
A free, independent scan of the public email-security records — SPF, DKIM and DMARC — behind Irish business domains. These are the records that help mailboxes decide whether a message is really from you.
Irish business domains.
Each county shaded by the share of its domains that effectively enforce DMARC. Shading is scaled to the actual national spread so differences are visible.
Each town plotted at its Eircode routing-key centre, sized by number of domains and shaded by effective enforcement.
Click another town to switch.
Share of each sector's domains effectively enforcing DMARC.
Click another sector to switch.
Where a mailbox provider could be identified from DNS. Only providers with 50+ domains shown. Provider detection is best-effort.
The plain-English status of a domain's email protection, based on effective policy.
Hey, I'm Michal. I work in IT in Castlebar — though not in business systems specifically.
While completing my MSc in Cybersecurity, I researched email authentication across Irish domains, and I stayed curious after finishing. I wanted to see whether a wider, independent scan was actually possible — not a sample, but a proper national picture of how Irish business domains protect themselves against fake email.
So I built TrustIndex to find out. It checks public SPF, DKIM and DMARC records, tracks the picture by county, town and sector, and explains in plain English what a business can fix next. It's not about naming anyone — it's about making the gap visible so it can be closed.
— Michal
Plain-English guides. Reach effective enforcement without dropping real mail.
DMARC helps reduce direct spoofing of your real domain. It does not stop lookalike domains (e.g. your-business.ie), compromised real mailboxes, fake invoices from a real supplier account, malware from unrelated domains, or poor decisions under pressure. It is domain identity-theft resistance — the foundation, not a guarantee against every attack.
SPF lists the servers allowed to send email for your domain. Active sending domains should tighten the default (to ~all then -all) only after every legitimate sender is known — your provider's guidance is the source of truth. Parked domains: publish v=spf1 -all.
DMARC ties SPF and DKIM to the visible From address: p=none (monitoring only), p=quarantine, or p=reject (receivers asked to reject failing mail). Modern DMARC follows RFC 9989. t=y signals a testing phase; pct is legacy.
1. Publish p=none with rua=. 2. Read reports until legitimate mail passes. 3. Move to p=quarantine (t=y while testing). 4. Move to p=reject. 5. Add sp/np, confirm DKIM with a test email.
Where the businesses come from. The official register of Irish companies. Only active companies are included — dissolved and struck-off ones are left out.
Finding each company's website. Company names are matched to domains, and each match is graded for confidence. Only strong matches count toward the public figures, so a business isn't credited with a domain that only looks similar.
What's checked. The public SPF, DKIM and DMARC records in a domain's DNS — the settings that tell mailboxes how to treat mail claiming to be from that domain. It's a read-only look-up. No email is ever sent, and nothing is logged in to.
Effective enforcement. A domain only counts as enforcing if it actually asks mailboxes to act on fake mail. A policy left in monitoring or testing mode looks strict but isn't, so it's counted honestly as not-yet-enforcing.
What it can't tell you. DNS shows how a domain is configured, not whether mail is delivered. Mailbox providers can apply their own rules, and some checks (like full DKIM alignment) would need a test email. This is a picture of configuration, not a delivery guarantee.
The full detail — how matching works, how the numbers reconcile, and every limitation — is on the methodology page.