didrod205/can-i-be-phished

can-i-be-phished 🎣

Can a scammer send email that looks like it came from your hospital, school, or charity? Paste any organization's domain and find out instantly. It checks whether the domain enforces DMARC — the setting that stops anyone from forging its address — and tells you, plainly, if it can be spoofed. No API key, runs in your browser, nothing about you is sent anywhere.

🌐 Check any domain + the wall of spoofable trusted institutions →

npx can-i-be-phished stjude.org
npx can-i-be-phished list --list charity

  wish.org · Make-A-Wish
  Spoofable 🎣 (25/100)

    • DMARC p=none — monitoring only; forged mail is still delivered to inboxes.
    • SPF ends in ~all (softfail) — permissive on its own.

  DMARC: v=DMARC1; p=none; rua=mailto:DMARCAlerts@wish.org; …

Why

Email is trivially forgeable by default — the only thing that stops a scammer from putting From: your-children's-hospital.org on a phishing email is a DNS record called DMARC set to p=reject. Most organizations never finish setting it up. The result: a snapshot of trusted institutions found that 27 of 48 — including Make-A-Wish, the Salvation Army, Doctors Without Borders (no DMARC at all), MIT, Penn State, and a children's hospital — don't fully block someone impersonating them. This tool lets anyone check the institutions they trust, and keeps a running wall of the ones that haven't fixed it.

How it works

DNS-over-HTTPS (Cloudflare / Google, keyless, CORS)  ─→  _dmarc.<domain> TXT → policy
                                                     ─→  <domain> TXT       → SPF
                                                              ↓
                                  p=reject → protected · p=none / missing → spoofable

• Runs anywhere — DoH is CORS-open and never rate-blocks, so the exact same

check runs in the CLI, in CI, and live in your browser (no backend, no key).

• Defensible — it reports a domain's published DNS policy. "Spoofable"

means a forged From: can reach inboxes; it is not a claim the org was hacked or that mail is being forged today. It's a fixable config.

• The live site is static: a daily GitHub Action re-checks the watchlist and

commits a fresh leaderboard. No server.

Install & usage

npm i -g can-i-be-phished     # then:  can-i-be-phished stjude.org
# or zero-install:
npx can-i-be-phished irs.gov

can-i-be-phished harvard.edu             # check one domain
can-i-be-phished list                    # check the whole trusted-institution watchlist
can-i-be-phished list --list childrens-hospital   # one category
can-i-be-phished stjude.org --json       # machine-readable