Public Tools Policy

Last updated 10 November 2026

This policy is part of the Terms of Service and applies together with the Acceptable Use Policy and the Privacy Policy.

1. What the tools are

The public tools (the "Tools") are the free DNS and email-authentication checks published on this Site and the public API behind them: the Domain Scan and Domain Checker, DMARC Inspector, SPF Check, DKIM Inspector, DKIM Validator, MTA-STS Checker, MTA-STS Policy Generator, DMARC Record Wizard, XML-to-human Converter and Email Header Analyser, and any tool we add later. They are provided by Visolute Pty Ltd (ABN 23 703 325 240) trading as DMARCLoop.

The Tools read publicly published information: the SPF, DKIM, DMARC, MX, MTA-STS, TLS-RPT and BIMI records in public DNS for a domain you supply, and in the MTA-STS case the policy file the standard requires to be publicly served. They do not attempt to access any system, do not send mail, and do not test authentication against live mail flow. Some Tools (the DMARC Record Wizard, the MTA-STS Policy Generator, the XML-to-human Converter and the Email Header Analyser) run entirely in your browser and send nothing to us.

2. Who may use them, and for what

The Tools are free, need no account and may be used by anyone for any lawful purpose, including commercially and on behalf of clients. You may check any domain whose records are public, because reading public DNS is not access to a system. You may use the output of a check (the records read, the findings and the remediation text) in your own work, including reports to your own clients, with or without attribution.

In return, you agree that you will not:

• use the Tools, or their output, to plan or support unauthorised access to, or an attack on, a domain or system you do not own or are not authorised to assess;
• use them for bulk or automated checking of domains, build a product or service on them, call the public API from your own software or embed the Tools in another site, without our prior written permission (see clause 4);
• circumvent rate limits or anti-abuse checks, rotate addresses to exceed them, or submit volume that degrades the Tools for others;
• resell, rebrand or present the Tools or their output as your own product, or remove the DMARCLoop name from a report the Tools produce for you;
• submit to the domain scan report form an email address you do not control, or to the contact form anything unlawful or misleading; or
• probe, disrupt or reverse engineer the infrastructure behind the Tools.

3. Fair use and rate limits

The Tools are shared by everyone who uses the Site, so each client is limited to a number of requests a minute, and a request beyond it is answered with a rate-limit finding rather than a result. Results are cached for a short time, so repeating a check at once may return the cached answer; the result says whether it did, and a fresh lookup can be requested. Some Tools use an anti-abuse check (Cloudflare Turnstile) before they run, and we may add or tighten these measures at any time. We may rate-limit, block or withdraw access from anyone we reasonably believe is breaching this policy.

4. Automated and integrated use

If you would like to check domains in bulk, call the checks from your own software, or embed a tool in your own site, ask us at contact at dmarcloop.com. Customers on a plan that includes the DMARCLoop API have a supported, documented and rate-limited interface for their own domains, which is the right route for continuous monitoring; MSP plans cover checking and monitoring domains for clients. We may authorise other uses in writing, with conditions, and may withdraw that authorisation.

5. What we do with the domains you check

• The query. For a server-side check we receive the domain (and, for DKIM, the selector) you asked about. We log it with a timestamp, the tool used and whether the answer came from the cache, so that we can rate-limit abuse, cache results and see which kinds of domains the Tools are used on. The log holds no IP address or browser details. Query logs are kept for up to 12 months and then deleted.
• The results of a check are cached briefly and otherwise not kept. We do not build a history of a domain from the Tools, and the Tools do not feed the monitoring Service for any customer.
• The domain scan report. If you ask for the full scan report by email we collect your email address and the domain, generate the PDF, email you a link to it that works for a limited time, and tell ourselves that you asked so a person can answer questions about it. We may send you at most one follow-up email asking whether you need help. We do not add you to a mailing list. The PDF is deleted 30 days after it is generated.
• Browser-only tools. The DMARC Record Wizard, the MTA-STS Policy Generator, the XML-to-human Converter and the Email Header Analyser run entirely on your device. Aggregate report files you open in the converter, and message headers you paste into the analyser, are read locally and are never uploaded, transmitted to us or stored by us.
• Analytics. We record that a tool was run, which tool and how severe the result was, as the Privacy Policy describes. What you type into a tool is never sent to analytics, and query strings are stripped from every page address before it is reported.

The Privacy Policy is the authoritative description of how we handle personal information collected through the Tools. Where this policy and it differ, it prevails.

6. Accuracy, and what the results are not

The Tools report what public DNS returned at the moment of the query and apply a published set of rules to it. DNS is cached, propagates unevenly and can differ between resolvers, so a result is a point-in-time observation and not a guarantee of what any given mail receiver will see. The domain scan's grade is our own summary of those findings, not a certification, and the DKIM selector probe checks only a list of common selectors, so it can miss keys that exist.

Findings are information, not advice. Publishing a DMARC policy of quarantine or reject, changing an SPF record, or publishing an MTA-STS policy in enforce mode can cause legitimate mail to be filtered or refused if a sending source has been missed. You are responsible for reviewing any DNS change before you make it and for its consequences. A record or policy generated by a Tool is a starting point you must check, not a recommendation to publish it unchanged.

7. Availability and changes

The Tools are provided free of charge, "as is" and without any uptime commitment. We may change, limit, suspend or withdraw any Tool, or the whole suite, at any time and without notice. We aim to keep them running and to warn about material changes where it is practical, but that is an intention, not a service level. Clauses 18 to 20 of the Terms of Service (warranties, the Australian Consumer Law and limitation of liability) apply to the Tools.

8. Intellectual property

The Tools, their rule catalogue, text, design and software belong to us or our licensors. Using them grants you no rights in them beyond using them as described here. The output of a check for a domain you queried is yours to use as clause 2 describes.

9. Contact

Questions about this policy, requests for automated or integrated use, and reports of misuse: contact at dmarcloop.com, or the contact form.