{"id":51417793,"url":"https://github.com/didrod205/can-i-be-phished","last_synced_at":"2026-07-04T21:30:40.875Z","repository":{"id":368123664,"uuid":"1283631253","full_name":"didrod205/can-i-be-phished","owner":"didrod205","description":"Can a scammer fake an email from your hospital, school, or charity? Checks any domain's DMARC and tells you if it can be spoofed — plus a leaderboard of trusted institutions that don't block impersonation. Public DNS, no API key, runs in your browser.","archived":false,"fork":false,"pushed_at":"2026-06-29T05:16:46.000Z","size":45,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-29T07:11:36.258Z","etag":null,"topics":["cli","dmarc","dns","email-security","no-api-key","phishing","security","spf","spoofing","typescript"],"latest_commit_sha":null,"homepage":"https://didrod205.github.io/can-i-be-phished/","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/didrod205.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-06-29T05:16:11.000Z","updated_at":"2026-06-29T05:16:49.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/didrod205/can-i-be-phished","commit_stats":null,"previous_names":["didrod205/can-i-be-phished"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/didrod205/can-i-be-phished","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/didrod205%2Fcan-i-be-phished","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/didrod205%2Fcan-i-be-phished/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/didrod205%2Fcan-i-be-phished/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/didrod205%2Fcan-i-be-phished/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/didrod205","download_url":"https://codeload.github.com/didrod205/can-i-be-phished/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/didrod205%2Fcan-i-be-phished/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35136712,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-04T02:00:05.987Z","response_time":113,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cli","dmarc","dns","email-security","no-api-key","phishing","security","spf","spoofing","typescript"],"created_at":"2026-07-04T21:30:39.980Z","updated_at":"2026-07-04T21:30:40.819Z","avatar_url":"https://github.com/didrod205.png","language":"TypeScript","funding_links":["https://github.com/sponsors/didrod205"],"categories":[],"sub_categories":[],"readme":"# can-i-be-phished 🎣\n\n**Can a scammer send email that looks like it came from your hospital, school, or charity?** Paste any organization's domain and find out instantly. It checks whether the domain enforces **DMARC** — the setting that stops anyone from forging its address — and tells you, plainly, if it can be spoofed. No API key, runs in your browser, nothing about you is sent anywhere.\n\n### 🌐 [**Check any domain + the wall of spoofable trusted institutions →**](https://didrod205.github.io/can-i-be-phished/)\n\n```bash\nnpx can-i-be-phished stjude.org\nnpx can-i-be-phished list --list charity\n```\n\n```\n  wish.org · Make-A-Wish\n  Spoofable 🎣 (25/100)\n\n    • DMARC p=none — monitoring only; forged mail is still delivered to inboxes.\n    • SPF ends in ~all (softfail) — permissive on its own.\n\n  DMARC: v=DMARC1; p=none; rua=mailto:DMARCAlerts@wish.org; …\n```\n\n## Why\n\nEmail is trivially forgeable by default — the only thing that stops a scammer\nfrom putting `From: your-children's-hospital.org` on a phishing email is a DNS\nrecord called **DMARC** set to `p=reject`. Most organizations never finish setting\nit up. The result: a snapshot of trusted institutions found that **27 of 48** —\nincluding **Make-A-Wish, the Salvation Army, Doctors Without Borders (no DMARC at\nall), MIT, Penn State, and a children's hospital** — don't fully block someone\nimpersonating them. This tool lets anyone check the institutions they trust, and\nkeeps a running wall of the ones that haven't fixed it.\n\n## How it works\n\n```\nDNS-over-HTTPS (Cloudflare / Google, keyless, CORS)  ─→  _dmarc.\u003cdomain\u003e TXT → policy\n                                                     ─→  \u003cdomain\u003e TXT       → SPF\n                                                              ↓\n                                  p=reject → protected · p=none / missing → spoofable\n```\n\n- **Runs anywhere** — DoH is CORS-open and never rate-blocks, so the exact same\n  check runs in the CLI, in CI, and **live in your browser** (no backend, no key).\n- **Defensible** — it reports a domain's **published DNS policy**. \"Spoofable\"\n  means a forged `From:` can reach inboxes; it is **not** a claim the org was\n  hacked or that mail is being forged today. It's a fixable config.\n- The **live site** is static: a daily GitHub Action re-checks the watchlist and\n  commits a fresh leaderboard. No server.\n\n## Install \u0026 usage\n\n```bash\nnpm i -g can-i-be-phished     # then:  can-i-be-phished stjude.org\n# or zero-install:\nnpx can-i-be-phished irs.gov\n```\n\n```bash\ncan-i-be-phished harvard.edu             # check one domain\ncan-i-be-phished list                    # check the whole trusted-institution watchlist\ncan-i-be-phished list --list childrens-hospital   # one category\ncan-i-be-phished stjude.org --json       # machine-readable\n```\n\n`phishcheck` is a shorter alias. Categories: `childrens-hospital`, `charity`,\n`university`, `school-district`, `government`.\n\n## What the verdict means\n\n| Verdict | DMARC policy | A forged email from this domain… |\n| --- | --- | --- |\n| **Protected** 🛡️ | `p=reject` | is rejected before the inbox |\n| **Partly protected** ⚠️ | `p=quarantine` (or `pct\u003c100`) | lands in spam, or some slips through |\n| **Spoofable** 🎣 | `p=none` or no DMARC | is delivered to the inbox |\n\n## Library\n\n```ts\nimport { analyzeDomain } from \"can-i-be-phished\";\n\nconst r = await analyzeDomain(\"salvationarmyusa.org\");\nr.verdict.band;     // \"spoofable\"\nr.dmarc.policy;     // \"none\"\nr.verdict.reasons;  // plain-English why\n```\n\n## Honesty \u0026 responsibility\n\nEverything here comes from a domain's **public** DNS — the same records every mail\nserver reads. The tool reports a **configuration fact** (\"this domain's DMARC\npolicy is `p=none`, so a forged From can reach inboxes\"), never an accusation that\nan organization was breached or is being impersonated right now. It deliberately\ndoes **not** explain how to spoof anyone — only whether a domain is protected, and\nthat the fix is to publish `p=reject`. It targets **organizations**, not people.\n\n## Contributing\n\nAdd an institution to the watchlist, or a check (DKIM, MTA-STS, BIMI). See\n[CONTRIBUTING.md](CONTRIBUTING.md).\n\n## License\n\nMIT © [didrod205](https://github.com/didrod205)\n\n---\n\n\u003csub\u003eIt's a public DNS record and a one-line fix. This just shows who hasn't shipped it. Judge for yourself.\u003c/sub\u003e\n\n## 💖 Sponsor\n\nFind this useful? [**Sponsor on GitHub**](https://github.com/sponsors/didrod205) — it keeps these projects maintained.\n\n[![Sponsor](https://img.shields.io/badge/Sponsor-GitHub-db61a2?logo=githubsponsors\u0026logoColor=white)](https://github.com/sponsors/didrod205)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdidrod205%2Fcan-i-be-phished","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdidrod205%2Fcan-i-be-phished","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdidrod205%2Fcan-i-be-phished/lists"}