Spoofable Status Badge
Generate an embeddable badge that shows your domain's live DMARC status.
Generate a live "spoofable status" badge for your domain. Enter a domain and we check its DMARC policy, then give you a small badge image you can embed anywhere. The badge updates itself automatically: every time someone loads it we re-read your live DMARC record, so it always shows the current state without you touching it. It links back to the full DMARC checker, which makes it handy for status pages, README files and security or trust pages. Nothing is stored.
example.com. We read its DMARC record live over DNS.
The Spoofable Status Badge generates an embeddable image that shows, at a glance, whether your domain is currently protected against email spoofing. It reads your live DMARC record (RFC 7489) from public DNS and reflects the real state, whether protected, partially protected or spoofable, so anyone visiting your site can see your stance on email authentication.
What makes a domain spoofable
DMARC is the policy that decides whether receivers reject mail that fails authentication. A domain is treated as spoofable when it has no DMARC record at all, or when DMARC is published only at p=none, which monitors but takes no action. It is protected when the policy is at enforcement (p=quarantine or p=reject), so forged messages are sent to spam or refused. The badge mirrors whichever state your DNS currently shows.
How to read the badge and fix a red result
If the badge shows your domain as spoofable, the fix is to publish a DMARC record and move it to enforcement:
- Publish a TXT record at
_dmarc.yourdomainstarting withv=DMARC1and aruareporting address. - Begin at
p=noneto gather aggregate reports, confirm every legitimate sender authenticates, then raise the policy top=quarantineand finallyp=reject. - Make sure SPF and DKIM are aligned for your real senders before enforcing, so you do not block your own mail.
Once the policy reaches enforcement the badge flips to protected automatically on its next check. Our enforcement guide covers the staged rollout, and the DMARC Engine done-for-you service can take a domain from spoofable to reject for you.
Frequently asked questions
When does the badge show my domain as protected?
When your DMARC record is at enforcement, that is, p=quarantine or p=reject. A record stuck at p=none, or no record at all, displays as spoofable because receivers take no action on forged mail.
Does the badge update automatically?
Yes. It reads your DMARC record live from DNS each time it is checked, so once you raise your policy to enforcement and the change propagates, the badge reflects the new status without any manual edit.
Is publishing this badge a security risk?
No. It only reveals the DMARC policy that is already public in your DNS, and anyone can query that record. The badge simply presents it in a human-readable form and does not expose anything additional.
Why does p=none count as spoofable?
Because p=none only requests reports; it instructs receivers to deliver failing mail normally. Until you move to p=quarantine or p=reject, an attacker can still send mail that appears to come from your domain.
I have SPF and DKIM but the badge still says spoofable. Why?
SPF and DKIM authenticate individual senders, but only DMARC tells receivers to act on failures. Without a DMARC record at enforcement, nothing instructs them to reject forgeries, so the domain remains spoofable despite valid SPF and DKIM.