Acceptable Use Policy

Last updated 9 November 2026

This policy is part of the Terms of Service. Words defined there have the same meaning here.

1. Purpose

DMARCLoop exists to help organisations see who sends mail as their domains and to protect those domains from abuse. This policy sets out how the Service, the Site, the API and the Tools may be used so that they stay useful, safe and available for everyone. It applies to every user of them: account holders, the people they invite, API keys, MSPs and their clients, and visitors using the free Tools. If you are an MSP you are responsible for your clients' compliance with it.

2. Lawful use only

You must not use the Service, Site, API or Tools:

• in breach of any law, regulation or court order, including privacy, spam, computer misuse, sanctions and export laws, in any country that applies to you;
• to infringe anyone's intellectual property, privacy or other rights;
• to send, support or conceal unsolicited bulk email, phishing, impersonation, fraud or malware, or to make such mail appear authenticated; or
• in a way that is defamatory, harassing, abusive or deceptive.

3. Domains you are authorised to manage

• Add only domains you own or are authorised by the owner to manage, and direct DMARC, TLS and failure reports to DMARCLoop only for those domains.
• Do not add a domain to obtain reports about an organisation without its knowledge or permission, or to interfere with its mail, and do not publish DNS records for a domain you are not authorised to manage.
• Do not use hosted DMARC, SPF, DKIM, MTA-STS or BIMI records for any domain other than those you are authorised to manage, and do not point a domain's records at our zones in a way we have not provided for.
• We may ask you to demonstrate control of a domain at any time and may remove a domain, or refuse reports for it, where we cannot verify your authority or someone with a better claim objects.

4. Security and integrity

You must not:

• attempt to gain unauthorised access to the Service, another customer's account or data, or any related system, network or account;
• probe, scan or test the vulnerability of the Service or its infrastructure, or breach or circumvent any security or authentication measure, without our prior written permission (see clause 9 for responsible disclosure);
• share account credentials, use another person's account without permission, or create accounts by automated means or under false details;
• introduce malware or malicious code, or upload content designed to exploit the Service, the people who use it or the reports it produces;
• interfere with the Service's operation, including by sending malformed, oversized or deceptive reports to our report addresses, flooding report addresses or webhooks, or deliberately triggering alerts or notifications to others; or
• reverse engineer, decompile or disassemble any part of the Service, except to the extent the law expressly permits despite this restriction.

5. Plan limits, rate limits and automation

• Stay within your plan's limits. Do not split one organisation across several accounts, hold more than one Free organisation, or use duplicate, related or client accounts to avoid plan limits or fees.
• The API, the MCP server, the public Tools and every other automated interface carry rate limits. Do not circumvent them, rotate keys, addresses or accounts to exceed them, or send automated volume that degrades the Service for others.
• Use API keys only for the operations we publish, and keep them secret. Revoke a key as soon as you suspect it has been exposed.
• Do not scrape, crawl, mirror or bulk-download the Site, the application or the Tools, other than through the exports and API we provide or the ordinary indexing of public pages by search engines.
• Do not use the Service, its data, its findings or its documentation to build, train or improve a competing product, or to benchmark it for publication without our written consent.

6. Resale, white-label and branding

• Do not resell, sublicense, white-label or provide the Service to third parties, or monitor domains for other organisations, unless you are on an MSP plan or we have authorised you in writing (Terms of Service, clause 8).
• If you use white-label features, use only brands, hostnames, logos and sending domains you have the right to use, and do not present the Service in a way that is misleading about who operates it where the Terms require disclosure.
• Do not use the DMARCLoop name, logo or marks, or imply any endorsement or partnership with us, except as we permit in writing. Linking to the Site, and saying that you use DMARCLoop, is fine.

7. Content, notifications and integrations

• You are responsible for Customer Content you upload, including logos and names, and for notes, messages and support requests you send. Do not upload content that is unlawful, infringing or offensive.
• Alert channels, digests, webhooks, chat and ticketing integrations and scheduled exports must be sent only to people and systems you are authorised to send them to. Do not configure them to target third parties.
• Keep DMARC failure (forensic) reports, which can contain personal information about the recipients and senders of mail, limited to the people in your organisation who need them, and handle them in accordance with privacy law.

8. How we enforce this policy

We may investigate suspected breaches and take any action we consider appropriate, without liability to you, including: warning you; removing a domain, record or content; rate-limiting, blocking or restricting access; suspending a user, an organisation or a client organisation; terminating an account; withholding or reversing credits; reporting conduct to law enforcement, registrars, hosting providers or mail receivers; and recovering our reasonable costs of investigation and remediation. Suspension and termination are described in clauses 15 and 16 of the Terms of Service. Where it is reasonable to do so we will tell you what we have found and give you an opportunity to put it right.

9. Reporting abuse and security issues

If you believe someone is using DMARCLoop in breach of this policy, or you have found a security vulnerability in the Service, Site or Tools, please tell us at contact at dmarcloop.com or through the contact form. Our security.txt is at /.well-known/security.txt. We ask that security researchers act in good faith: do not access or alter other customers' data, do not degrade the Service, give us a reasonable time to fix a problem before publishing it, and do not use automated scanning against production without asking first. We will not pursue good-faith research that follows these rules.

10. Changes

We may update this policy as the Service and the ways it can be misused change. The "last updated" date above changes when we do, and material changes are notified as the Terms of Service describe.