Every ThreatDNS domain report shows the domain’s email security records. Here’s how to read them.
SPF lists the mail servers allowed to send email for the domain. DMARC tells receiving mail servers what to do when a message fails those checks: nothing (p=none), send it to spam (quarantine) or refuse it (reject).
What a missing or weak DMARC means: it’s easier for someone to send email that pretends to come from that domain. It’s a gap the domain owner should fix, not proof the domain is malicious.
What a perfect setup doesn’t mean: a phishing domain can have flawless SPF and DMARC. They only prove the email really came from that domain, so a lookalike such as paypa1-support[.]com passes too. Always check the domain itself: its age, its reputation and whether it imitates a brand.
Check any domain here: https://threatdns.com/?utm_source=reddit&utm_medium=community&utm_campaign=spf-dmarc
Seen a convincing email from a lookalike domain? Post it below, defanged.
Source: r/threatdns · by /u/dnsafe