Email spoofing check

Runs the SPF and DMARC checks and reads the DMARC policy that applies: none, partial (enforced with gaps such as pct below 100 or a subdomain policy that works out as none) or full. It describes the published policy, not whether forged mail gets through: the receiving server decides, and DKIM is not assessed.

Updated 2026-10-28

What this tool checks

The SPF and DMARC records are looked up as the SPF check and the DMARC check do, and the DMARC policy that applies to the domain decides the level:

None: no valid DMARC policy, or one that works out as none.
Partial: quarantine or reject, but with pct below 100 or a subdomain policy that works out as none.
Full: quarantine or reject for the domain and its subdomains, for all mail.

How to read the result

The level comes with the effective policy, the subdomain policy, pct, test mode and the SPF all qualifier. The findings are those of the SPF and DMARC checks, plus one for open subdomains.

Limitations

DKIM keys are not looked up, because their selectors are not published; the DKIM selector finder tries common ones.
No test message is sent: the result is the policy the domain publishes.

Use it from code

API reference for Email spoofing check

curl -i "https://api.lookproof.dev/v1/mail/spoofable?domain=example.com"

A request without payment is answered with 402 Payment Required and the exact price. See the API reference.

Limits

Input	Domain
Deadline	10 seconds
Freshness	Up to 5 minutes, never longer than the record TTL
Price	$0.01 per check

Findings this tool can report

Check (1)

Warning CHECK_QUERY_BUDGET_EXCEEDED The check stopped after reaching its DNS query limit.

DMARC (12)

Info DMARC_HISTORIC_TAG The DMARC record contains a tag that RFC 9989 lists as historic.
Info DMARC_INHERITED The DMARC policy comes from a parent domain.
Error DMARC_INVALID_POLICY The DMARC record has an invalid p, sp or np tag.
Error DMARC_MULTIPLE_RECORDS More than one DMARC record was found.
Warning DMARC_NOT_FOUND No DMARC record was found for the domain or any of its parent domains.
Info DMARC_NO_RUA The DMARC record has no aggregate report address (rua).
Info DMARC_PARTIAL_PCT The DMARC record uses pct below 100, a tag that RFC 9989 removed.
Info DMARC_POLICY_NONE The DMARC policy is p=none (monitoring only).
Error DMARC_SYNTAX_ERROR The DMARC record contains a tag that cannot be parsed or has an invalid value.
Info DMARC_TESTING_MODE The DMARC policy is in testing mode (t=y).
Info DMARC_UNKNOWN_TAG The DMARC record contains tags that are not defined.
Info DMARC_UNSUPPORTED_REPORT_URI A DMARC report address uses a scheme other than mailto.

DNS (3)

Error DNS_DOMAIN_NOT_FOUND The DNS resolver reported that the domain does not exist.
Warning DNS_RESOLVER_FAILURE The DNS resolver returned a server failure.
Warning DNS_RESOLVER_TIMEOUT The DNS resolver did not answer in time.

SPF (13)

Error SPF_INCLUDE_LOOP The SPF chain returns to a domain it already evaluated.
Error SPF_INCLUDE_NOT_FOUND An included or redirected domain has no SPF record.
Info SPF_MACRO_NOT_EVALUATED An SPF record contains macros that were not evaluated.
Error SPF_MULTIPLE_RECORDS More than one SPF record was found for a name in the SPF chain.
Warning SPF_NEUTRAL_ALL The SPF policy ends with ?all.
Warning SPF_NOT_FOUND No SPF record was found for the domain.
Warning SPF_NO_ALL The SPF record has no all mechanism and no redirect.
Error SPF_PASS_ALL The SPF policy ends with +all.
Warning SPF_PTR_MECHANISM An SPF record uses the ptr mechanism.
Info SPF_SOFTFAIL_ALL The SPF policy ends with softfail (~all).
Error SPF_SYNTAX_ERROR An SPF record contains a term that cannot be parsed.
Error SPF_TOO_MANY_LOOKUPS The SPF record needs more than 10 DNS lookups.
Error SPF_TOO_MANY_VOID_LOOKUPS More than two SPF lookups returned no data.

Spoof (1)

Warning SPOOF_SUBDOMAINS_UNPROTECTED The DMARC policy is enforced for the domain but not for its subdomains.

Frequently asked questions

Does full mean nobody can forge my domain?

No. Full means the published DMARC policy asks receivers to quarantine or reject mail that fails DMARC, for the domain and its subdomains. Each receiving server decides for itself, and DKIM is not assessed, so the tool describes the policy, not what happens to a given message.

What counts as partial?

An enforcing policy with a gap: pct below 100, which older receivers still read, or a subdomain policy that works out as none (SPOOF_SUBDOMAINS_UNPROTECTED). The gaps are listed in the result.

How does test mode change the result?

RFC 9989 lets a record ask for test mode with t=y; receivers then apply one step less, so reject acts as quarantine and quarantine as none. The effective policies in the result already include that step.