DMARC Policy Check
Fetch and grade a domain's DMARC record at _dmarc.<domain>: policy (none/quarantine/reject), alignment modes, aggregate-report (rua) and failure-report (ruf) destinations, and the percentage applied. DMARC is what actually stops spoofing — p=none grades C even though most domains sit there.
🔌 Server-side tool
This tool runs on the server (it fetches third-party URLs directly and cannot run in your browser). Use the paid JSON API below — the worked examples show real server-side results and refresh automatically.
Worked examples
Google's DMARC
GET /api/v1/security/dmarc-check?domain=gmail.com
Result: Grade C — p=none · reports configured
A bank (strict)
GET /api/v1/security/dmarc-check?domain=paypal.com
Result: Grade A — p=reject · reports configured
No DMARC
GET /api/v1/security/dmarc-check?domain=example.org
Result: Grade A — p=reject · no reports
Machine API (x402)
$0.02 / callThis tool is also a JSON API for AI agents. Requests without payment receive 402 Payment Required plus instructions; agents pay USDC on Base via the x402 protocol — no accounts, no API keys.
GET /api/v1/security/dmarc-check?domain=gmail.com HTTP/1.1
Host: agentstoolshub.com
→ 402 (payment required, instructions in headers)
→ 200 (after X-PAYMENT header; JSON body below)
{
"tool": "security/dmarc-check",
"input": {"domain":"gmail.com"},
"result": { "value": 25, "answer": "Grade C — p=none · reports configured" }
}Agent docs: /llms.txt · OpenAPI spec · integration guide
About this tool
Grades the DMARC policy that decides whether spoofed mail from a domain gets delivered, junked or rejected — plus alignment modes, reporting destinations and rollout percentage. p=none (the default most domains sit at) scores C: it monitors but protects nothing.
Frequently asked questions
Why does DMARC matter more than SPF?
SPF and DKIM authenticate individual messages; DMARC is the policy that tells receivers what to do when they fail, aligned to the visible From: domain. Without DMARC, a passing-SPF spoofed From: header still delivers.
What's the rollout path?
p=none with rua= to collect reports, tighten SPF/DKIM alignment, then move to p=quarantine and finally p=reject — each step visible in this tool's grade.