Pazmo
New run
Sign in
arrow_backBack to your run
Low carddns.dmarc_policy_weak

Email spoofing

Play this card on https://example.com. Everything a developer (or your AI agent) needs to fix and verify it — free. Fixing your own site is never paywalled.

visibilityCard text — what this means

Demo DNS evidence indicates DMARC is missing or not enforcing.

DMARC enforcement tells receivers how to handle mail that fails SPF/DKIM alignment.

Preview ingestion does not query DNS directly.

playing_cardsHow to play it

Move DMARC gradually from p=none to quarantine or reject after monitoring.

  1. 1Review aggregate DMARC reports for legitimate senders.
  2. 2Fix SPF and DKIM alignment for approved mail sources.
  3. 3Move policy from monitoring to quarantine or reject in stages.

Fix it on your stack

Add this record at your DNS provider — it's the same regardless of web stack.

dns
Type: TXT
Host/Name: _dmarc
Value: v=DMARC1; p=quarantine; rua=mailto:dmarc@your-domain.example

infoMove from p=none toward quarantine, then reject, once you have confirmed legitimate senders are aligned. Add this record at your DNS provider (registrar or DNS host) — it is the same regardless of web stack.

workspace_premiumClaim your endorsement

Pazmo checks DNS for a stronger DMARC policy.

Evidence needed: Sanitized DNS evidence showing the updated DMARC policy value.

Related controls

Readiness mapping only — evidence relevant to these controls. Pazmo does not determine, certify, or guarantee compliance.

  • A.8.21 · Security of network services (ISO/IEC 27001:2022)
SOC 2 SecurityISO/IEC 27001 evidenceVendor review
smart_toyHand this card to your AI agentBack to your run