Overview
A DMARC record lookup API. This tool queries DNS records to inspect and validate the DMARC record associated with a domain. It analyzes policy strength, formatting and alignment modes, derives whether the domain actively enforces DMARC and a composite email-spoofing risk score, and provides guidance for better email deliverability and protection against spoofing.
Live Test Validate DMARC Source →
Formula
One function covers the whole catalog: the first argument names the source, the rest are its inputs, and the "field" pair says which single value lands in the cell. Formulas covers the grammar that applies to all of them.
=VERVE("dmarcvalidator", A2, "field", "host")=VERVE.CALL("dmarcvalidator", A2, "field", "host")A2 holds the domain you are looking up. Drag the formula down and each row resolves on its own.
With literal values
Nothing has to come from a cell — typed values work the same way.
=VERVE("dmarcvalidator", "paypal.com", "field", "host")=VERVE.CALL("dmarcvalidator", "paypal.com", "field", "host")Inputs
Required inputs are positional, in the order below. Everything else is passed as a "name", value pair after them — the same shape as SUMIFS. Premium inputs are accepted on every plan but only take effect on plans that include them.
| Input | Type | Where it goes | Description |
|---|---|---|---|
domainRequired | string | argument 2 (A2) | The domain to validate the DMARC record for domain |
What lands in your sheet
The "field" pair is what makes the formula resolve to one cell. Its value is a dot-path from the table below, so swapping it is how you pull a different value — one formula per column.
Seeing everything at once
Drop the "field" pair and the formula returns the whole response instead: two columns, field name on the left and value on the right, spilling from the cell you typed in.
=VERVE("dmarcvalidator", A2)=VERVE.CALL("dmarcvalidator", A2)The second row's table would land on top of the first's, and every cell after the first reads #REF! (#SPILL! in Excel). Keep one per sheet, or name a field, and leave the cells below and to the right empty.
Response fields
Paths are relative to data. Each one is exactly what the "field" pair accepts, so swapping it is how you pull a different value into a cell. On a plan without a Premium field the cell reads #PREMIUM(field) rather than a value, so a locked field never looks like a real answer.
| Use as "field" | Type | Example cell value | Description |
|---|---|---|---|
host | string | paypal.com | The domain name that was validated |
dmarcHost | string | _dmarc.paypal.com | The DMARC DNS record hostname for the domain |
hasDmarc | boolean | true | Indicates whether a DMARC record exists for domain |
dmarc_record | string | v=DMARC1; p=reject; rua=mailto:[email protected],mailto:[email protected]; ruf=mailto:[email protected],mailto:[email protected] | The complete DMARC record string from DNS |
rua | object | {…} | Aggregate report destination from the rua tag, with the address and whether it is valid |
rua.emailPremium | string | [email protected],[email protected] | Email address for aggregate report delivery |
rua.domain | string | rua.agari.com | Domain name extracted from aggregate report email |
rua.validPremium | boolean | true | Indicates if aggregate report email is valid |
ruf | object | {…} | Forensic report destination from the ruf tag, with the address and whether it is valid |
ruf.emailPremium | string | [email protected],[email protected] | Email address for forensic report delivery |
ruf.domain | string | ruf.agari.com | Domain name extracted from forensic report email |
ruf.validPremium | boolean | true | Indicates if forensic report email is valid |
v | string | DMARC1 | DMARC protocol version from record |
p | string | reject | DMARC policy for domain (reject, quarantine, none) |
sp | object | null | Policy applied to subdomains from the sp tag; null when the record does not set one |
pct | object | null | Percentage of mail the policy applies to from the pct tag; null means the default of 100 |
adkim | object | null | DKIM alignment mode from the adkim tag, relaxed or strict; null means the default of relaxed |
aspf | object | null | SPF alignment mode from the aspf tag, relaxed or strict; null means the default of relaxed |
fo | object | null | Forensic reporting options from the fo tag, controlling when a report is generated |
rf | object | null | Forensic report format from the rf tag |
ri | object | null | Requested interval between aggregate reports in seconds, from the ri tag |
valid | boolean | true | Overall validation status of DMARC record |
issues | array | [] | Problems found in the record, such as a missing policy or an unreachable report address |
isEnforcedPremium | boolean | true | Whether the domain actively enforces DMARC — policy is quarantine or reject and applied to 100% of mail. False for monitoring-only (p=none), partial rollout (pct<100), or no DMARC record |
riskScorePremium | number | 5 | Composite 0-100 email-spoofing risk based on the DMARC policy and rollout percentage — higher means the domain is more easily spoofed (no DMARC or p=none scores high; enforced reject scores low) |
riskLevelPremium | string | low | Risk band derived from the score: low, medium or high |
Filling a whole column
Both platforms make one batched call for a column rather than one request per cell, and both cost the same — 10 credits per row looked up. How you write it differs, because the two runtimes batch at different points.
=VERVE("dmarcvalidator", A2:A100, "field", "host")In Google Sheets, give the arguments ranges and the answers spill down from the cell you typed in. Custom functions there run synchronously and in isolation, so dragged cells cannot be coalesced — the range form is how a column becomes one call. The "field" pair is required here: a per-row two-column table has nowhere to spill. Use a full column per input (A2:A100, not A2) — a single-cell reference is read as row 1 only and the rest of the column comes back blank.
In Excel, type the formula once and fill down — no range form and none needed, because its runtime is asynchronous and the add-in coalesces the calls a fill produces into a single batched request. Do not hand VERVE.CALL a range: Excel flattens it into positional arguments, so A2:A100 arrives as a hundred separate arguments and the cell reads #ERR rather than filling.
Either way, column A holds your domain values and the answers land beside them, one row each, blank rows skipped.
When a cell doesn't fill
A failed lookup returns readable text starting with #ERR rather than a spreadsheet error, because Excel cannot show a custom message on a real error — you would get a bare #VALUE! with no reason. The trade-off is that IFERROR() will not catch it; test with LEFT(cell, 4) = "#ERR" instead. Error handling covers the rest.
| Cell reads | What happened |
|---|---|
#ERR Not connected | No API key saved. Open the side panel and connect your account. |
#ERR Replace <name> with a cell or value | A preview formula was copied as-is. Swap the placeholder for a cell reference. |
#ERR No "x" in dmarcvalidator | An option name this source does not take. The message lists the ones it does. |
#ERR No data point "…" | The "field" path is not in the response. Check it against the table above. |
#PREMIUM(field) | The field exists but your plan does not include it. |
#ERR Out of credits | The cycle's credits are spent. Usage resets on your billing date. |
Before the formula works
The add-in reads the API key you saved once in the side panel — the key never goes in the formula, so a shared sheet does not leak it and a collaborator without access simply sees the last calculated values.
- Install the add-in for Google Sheets or Excel.
- Open the side panel and sign in, or paste a key from your dashboard.
- Type the formula above into any cell.
Use cases
- Vendor Security Audits
- Audit partner domains during vendor reviews by inspecting their published DMARC policy and flagging entries set to none instead of reject.
- Outbound Campaign Verification
- Before sending mass marketing broadcasts, deliverability platforms verify sender domains to confirm that DMARC records exist and specify strict alignment modes.
- Inbound Mail Protection
- To stop spoofed sender addresses, secure email gateways evaluate incoming message domains against live DMARC policies and quarantine suspicious traffic.
- Domain Portfolio Health
- DNS administrators track customer domains across registrars to detect misconfigured report addresses, missing subdomain policies, and unaddressed syntax issues.
Other ways to use Validate DMARC
Set up Validate DMARC on VerveSheets, or reach the same source a different way. Your VerveSheets account and credits work on all of them — one key, one balance.
Related
More in Domain Data: