How to Audit Every Domain Your Company Owns (DMARC, CNAMEs and Redirects)

Run every domain your company owns through three checks: DMARC, CNAMEs and redirects. Spare domains, typo domains, old campaign sites and acquired brands are where spoofing, dangling records and broken redirects hide, because nobody looks at them. The bulk DMARC checker, bulk CNAME lookup and bulk redirect checker each take the whole list at once.

Start with DMARC on every domain →

Run the three checks

1. Make the list. Your registrar account's domain list is the source of truth; add domains held at other registrars or by other teams.
2. DMARC. Paste the domains into the bulk DMARC checker and press Check DMARC. Filter to No DMARC and Monitoring only.
3. CNAMEs. Export each zone's hostnames, paste them into the bulk CNAME lookup and press Look up CNAMEs. Filter to Dangling and Doesn't exist.
4. Redirects. Paste each domain as http://domain into the bulk redirect checker and press Check redirects. Filter to Broken, Loop and long chains.

Each tool takes up to 100 lines a run, or 500 after a free Google sign-in, and downloads a CSV.

Do it by hand

One loop for DMARC, MX, SPF and where the website lands:

printf "fb.com\ninstagr.am\nwikipedia.com\n" > portfolio.txt

while read -r d; do
  p=$(dig +short txt "_dmarc.$d" | tr -d '"' | grep '^v=DMARC1' | sed -n 's/.*[; ]p=\([a-z]*\).*/\1/p')
  mx=$(dig +short mx "$d" | sort -n | head -1)
  spf=$(dig +short txt "$d" | grep -o 'v=spf1[^"]*' | head -1 | cut -c1-20)
  web=$(curl -s -o /dev/null -m 10 -L -w '%{num_redirects} hops,%{http_code},%{url_effective}' "http://$d")
  echo "$d | dmarc=${p:-NONE} | mx=${mx:-none} | spf=${spf:-none} | $web"
done < portfolio.txt
# fb.com | dmarc=reject | mx=10 mxa-00082601.gslb.pphosted.com. | spf=v=spf1 redirect=_spf | 2 hops,200,https://www.facebook.com/
# instagr.am | dmarc=reject | mx=1 ASPMX.L.GOOGLE.COM. | spf=v=spf1 include:spf.m | 2 hops,200,https://www.instagram.com/
# wikipedia.com | dmarc=NONE | mx=none | spf=v=spf1 -all | 2 hops,200,https://www.wikipedia.org/

We ran this on 9 November 2026 on three public short or alternate domains. The cut keeps the SPF column short; drop it to see the full record. For the CNAME part, use the loop in find dangling CNAMEs.

The third row is the typical spare domain: no MX and an SPF record that allows no sender, but no DMARC record, so nothing asks receivers to reject mail spoofing it.

What each spare domain should look like

• Sends no mail: an SPF record of v=spf1 -all and a DMARC record with p=reject. With no legitimate mail to break, there's no reason to start at none. See DMARC record examples for the parked-domain record.
• Receives no mail: a null MX. RFC 7505 defines it as a single MX record with preference 0 and a target of ., which tells senders the domain accepts no mail. See null MX records.
• Made-up subdomains: RFC 9989, the DMARC standard since May 2026, adds np= for subdomains that don't exist. Without it, sp= or p= applies to them.
• Website: one or two permanent hops to a live page. A spare domain answering with a registrar's parking page or an error looks abandoned; see what a parked domain is.
• No dangling CNAMEs. Remove records for services you no longer use. MDN's subdomain takeover page recommends keeping "an inventory of all of your organization's domains and their hosting providers" so nothing is left dangling. The domain list you just made is that inventory.

Next step: check the domains you actually send from

Spare domains need locking down; sending domains need clean lists. Upload the list you send to at /verify to check every mailbox without sending. The first 100 checks are free with a Google sign-in, no card.

Pro, $39 a month: Unlimited email verification.* Never metered, never cut off. See pricing.

*Fair use: the first 100,000 checks a month at full speed, then slower, never cut off.

More: check DMARC for all your client domains, monitor your sending domains.