DMARC Protected badge
Show visitors that your domain rejects spoofed mail. The badge is free for domains with DMARC p=reject: verify the domain with one TXT record, and we check it again every day. No account, no email address.
Get your badge
Embed code
After verification you get this code with your own domain. Add ?theme=dark to the image address for the dark theme.
<a href="https://lookproof.dev/check/example.com?ref=badge" target="_blank" rel="noopener"><img src="https://lookproof.dev/badge/example.com.svg" alt="DMARC protected, checked by Lookproof" width="260" height="48"></a>How it works
- Enter your domain. You get a random token and a TXT record to add at
_lookproof.<your domain>:lookproof-verify=<token>. It has its own name, so your other TXT records are not touched. - Add the record at your DNS provider and click Verify. We look up the record and then check your DMARC policy.
- If the policy is reject, the badge is ready: copy the embed code into your site. If not, you get an explanation and links to the full check and to the steps that move your policy to reject.
Nothing is needed besides the TXT record: no account and no email address. The token is valid for seven days. You can leave the TXT record in place: the daily check uses it to confirm that you still want the badge.
What the badge says
The badge says "DMARC: Protected", "checked by Lookproof" and the date of the last check. It shows no findings and no other category. It is generated when you verify and after each daily check, so it always shows the state at the last check.
If the domain's policy is no longer reject, the same address shows a neutral grey badge, "Lookproof: status changed", which links to the full check. A badge for a domain that was never verified does not exist: its address answers 404, so the badge cannot be used as a free lookup.
Terms
- The badge is free.
- The link around the badge must stay, unchanged, as in the embed code.
- The badge reflects the status at the last check. It is not a guarantee of anything, and Lookproof gives no warranty for it.
- You remove the badge by deleting the TXT record, see the questions below.
The terms and the privacy notice of Lookproof apply as well.
Frequently asked questions
Which domains can get the badge?
Only a domain whose owner has proved control with the TXT record, and whose DMARC policy is reject when we check it, for subdomains too: an sp or np tag weaker than reject means no badge. A domain with p=quarantine, p=none, no DMARC record or a broken record gets no badge, only an explanation and links to fix it. We use the same rules as the free email security check, including test mode (t=y), which counts as one step weaker.
What does Protected mean, exactly?
That at the last check, the domain published a valid DMARC record with the policy reject, so receivers are asked to refuse mail that fails DMARC. It is not a guarantee: it says nothing about mail servers, passwords or receivers that ignore DMARC, and it describes the published records, not how every receiver acts on them.
How often is the badge checked?
Every day. We look up the TXT record and run the same DMARC check again. The date on the badge is the date of the last successful check. If the policy is no longer reject, the badge turns into a grey "Lookproof: status changed" badge that links to the full check. It never shows Protected on old information: after seven days without a successful check it turns grey as well.
How do I remove the badge?
Delete the lookproof-verify TXT record at _lookproof. At the next daily check the badge is deactivated: the image shows the grey status changed badge for 30 days, so pages that still embed it do not break at once, and after that the badge URL answers 404. Remove the embed code from your site too.
What do you store about my domain?
The domain, the verification token, the badge status, when it was verified and when it was last checked. No account, no email address and no IP address. Badge views and clicks are counted per day in total, not per visitor.
Can I change the badge or remove the link?
You can pick the light or the dark theme. The badge must keep its link to the check page: that link is how visitors can see the current status for themselves, and it is the condition for using the badge for free.