Domain & email exposure diagnostic
Enter the domain your company currently trades on (for example, a .co.uk, .de, .io, .net or hyphenated name). This tool queries live DNS and registry RDAP records to show whether the exact-match .com is registered, whether it has active mail servers capable of receiving mistyped email, and how both domains are protected against spoofing.
Queries public DNS (MX, TXT SPF, TXT DMARC, NS) and Verisign RDAP in real time. No queries are logged or shared.
How to read the diagnostic
Three public signals determine whether an unowned .com is a quiet nuisance or an active operational leak.
1. Inbound mail on the .com (MX records)
When a company trades on brand.co.uk or brand.io, customers and suppliers inevitably type @brand.com. If the .com publishes active MX records (and is not using a Null MX 0 .), those mistyped messages do not bounce at the DNS layer; they are delivered to the mail server of whoever controls the .com. Read more in The mail you are not receiving.
2. Outbound spoofing posture (SPF & DMARC)
Even on domains you own, a permissive SPF record (~all or missing) combined with a monitoring-only DMARC policy (p=none or missing) allows third parties to forge mail from your domain. Core domains and defensive variants alike should publish v=spf1 ... -all and v=DMARC1; p=reject;.
3. Registry creation date & locks (RDAP)
The Verisign RDAP record shows when the .com was first registered and its current EPP status codes (such as clientTransferProhibited). If the .com predates your trademark, a UDRP complaint will usually fail on the bad-faith registration element, making an anonymous purchase the practical route.
4. When to commission a full review
This tool compares a single domain against its direct .com counterpart. A full brand and email protection review maps every hyphenated variant, common typo, and regional ccTLD across your markets, ranks them by live mail exposure, and estimates what closing each gap would cost.
Want to close an exposure gap?
Write to Sarah Caldwell with the domain you tested. If the .com is held by a third party, we can approach the registrant anonymously on your behalf.