supermarkets

Understanding the Security Status

✓ Green (Secure): A valid DMARC policy is active. The domain is protected because the policy is set to either quarantine or reject, effectively blocking or flagging unauthorized emails as mandated in the Payment Card Industry Data Security Standard (PCI DSS).
× Red (Inadequate): The domain fails to meet the "low bar" set by PCI DSS as the minimum requirement for protection. This occurs if the record is missing, duplicated, or if the policy is set to none (monitoring mode only), which does not stop spoofing attempts.

DMARC records are cached and refreshed periodically. The logic has been updated in line with RFC 9989, published in May 2026, and now uses DNS Tree Walk.

aldi.co.uk →

DMARC Record: _dmarc.aldi.co.uk
v=DMARC1; p=reject; rua=mailto:db05ccb3@mxtoolbox.dmarc-report.com; ruf=mailto:db05ccb3@forensics.dmarc-report.com; adkim=r; aspf=r; fo=0:1:s
✓ Secure: Single valid policy detected

asda.com →

DMARC Record: _dmarc.asda.com
v=DMARC1; p=none; rua=mailto:dmarc-rua@asda.uk; ruf=mailto:dmarc-ruf@asda.uk; fo=1; pct=100;
× Warning: Main policy (p=none) is for monitoring only and does not prevent spoofing

asda.uk →

DMARC Record: _dmarc.asda.uk
v=DMARC1; p=reject; rua=mailto:dmarc-rua@asda.uk; ruf=mailto:dmarc-ruf@asda.uk; fo=1; pct=100; aspf=s; adkim=s
✓ Secure: Single valid policy detected

coop.co.uk →

DMARC Record: _dmarc.coop.co.uk
v=DMARC1; p=none; pct=100; fo=1; ri=3600; rua=mailto:a7bf599f@inbox.eu.redsift.cloud; ruf=mailto:a7bf599f@inbox.eu.redsift.cloud;
× Warning: Main policy (p=none) is for monitoring only and does not prevent spoofing

co-op.co.uk →

DMARC Record: _dmarc.co-op.co.uk
v=DMARC1; p=none; pct=100; fo=1; ri=3600; rua=mailto:a7bf599f@inbox.eu.redsift.cloud; ruf=mailto:a7bf599f@inbox.eu.redsift.cloud;
× Warning: Main policy (p=none) is for monitoring only and does not prevent spoofing

farmfoods.co.uk →

DMARC Record: _dmarc.farmfoods.co.uk
v=DMARC1; p=none; rua=mailto:dmarcreports@farmfoods.co.uk
× Warning: Main policy (p=none) is for monitoring only and does not prevent spoofing

iceland.co.uk →

DMARC Record: _dmarc.iceland.co.uk
v=DMARC1; p=reject; rua=mailto:dmarc_agg@vali.email,mailto:dmarc.reporting.rua@iceland.co.uk; ruf=mailto:DMARC.Failure.Reports@Iceland.Co.Uk
✓ Secure: Single valid policy detected

lidl.co.uk →

DMARC Record: _dmarc.lidl.co.uk
v=DMARC1; p=reject; adkim=r; aspf=r; rua=mailto:lgbdmarc@lidl.co.uk,mailto:schwarz-dmarc-rua@sasms.mail.schwarz; ruf=mailto:lgbdmarc-ruf@lidl.co.uk;
✓ Secure: Single valid policy detected

lidl-ni.co.uk →

DMARC Record: _dmarc.lidl-ni.co.uk
v=DMARC1
× Warning: No main policy (p=) found in DMARC record

marksandspencer.com →

DMARC Record: _dmarc.marksandspencer.com
v=DMARC1; p=reject; sp=reject; fo=1; pct=100; ri=3600; rua=mailto:marks-spencer@rua.agari-eu.com; ruf=mailto:marks-spencer@ruf.agari-eu.com
✓ Secure: Single valid policy detected

marks-and-spencer.com →

DMARC Record: _dmarc.marks-and-spencer.com
v=DMARC1; p=reject; fo=1; pct=100; ri=3600; rua=mailto:marks-spencer@rua.agari-eu.com; ruf=mailto:marks-spencer@ruf.agari-eu.com
✓ Secure: Single valid policy detected

morrisons.com →

DMARC Record: _dmarc.morrisons.com
v=DMARC1; p=reject; pct=100; sp=none; fo=1; ri=3600; rua=mailto:79a0cda2@inbox.ondmarc.com; ruf=mailto:79a0cda2@inbox.ondmarc.com
× Warning: Subdomain policy (sp=none) leaves subdomains vulnerable

morrisonsplc.co.uk →

DMARC Record: _dmarc.morrisonsplc.co.uk
v=DMARC1; p=reject; pct=100; fo=1; ri=3600; rua=mailto:79a0cda2@inbox.ondmarc.com; ruf=mailto:79a0cda2@inbox.ondmarc.com;
✓ Secure: Single valid policy detected

ocado.com →

DMARC Record: _dmarc.ocado.com
v=DMARC1; p=none; sp=none; fo=1; pct=100; rf=afrf; rua=mailto:dmarc-reports@ocado.com; ruf=mailto:dmarc-forensics@ocado.com
× Warning: Main policy (p=none) is for monitoring only and does not prevent spoofing
× Warning: Subdomain policy (sp=none) leaves subdomains vulnerable

ocadogroup.com →

DMARC Record: _dmarc.ocadogroup.com
v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc-reports@ocadogroup.com; ruf=mailto:dmarc-forensics@ocadogroup.com; fo=1
✓ Secure: Single valid policy detected

ocadoretail.com →

DMARC Record: _dmarc.ocadoretail.com
v=DMARC1; p=none; rua=mailto:dmarc_agg@vali.email; ruf=mailto:dmarc-forensics@ocadoretail.com
× Warning: Main policy (p=none) is for monitoring only and does not prevent spoofing

sainsburys.co.uk →

DMARC Record: _dmarc.sainsburys.co.uk
v=DMARC1; p=reject; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com; aspf=r; fo=1
✓ Secure: Single valid policy detected

spar.co.uk →

DMARC Record: _dmarc.spar.co.uk
v=DMARC1; p=none; fo=1; rua=mailto:rua+spar.co.uk@dmarc.barracudanetworks.com; ruf=mailto:ruf+spar.co.uk@dmarc.barracudanetworks.com
× Warning: Main policy (p=none) is for monitoring only and does not prevent spoofing

spar-ni.co.uk →

DMARC Record: _dmarc.spar-ni.co.uk
v=DMARC1; p=reject; pct=100; rua=mailto:a.z6ssqbdu@sdmarc.net
✓ Secure: Single valid policy detected

sparscotland.co.uk →

DMARC Record: _dmarc.sparscotland.co.uk
v=DMARC1; p=none
× Warning: Main policy (p=none) is for monitoring only and does not prevent spoofing

tesco.com →

DMARC Record: _dmarc.tesco.com
v=DMARC1; p=reject; fo=1; ri=3600; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com
✓ Secure: Single valid policy detected

tesco.co.uk →

DMARC Record: _dmarc.tesco.co.uk
v=DMARC1; p=reject; fo=1; ri=3600; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com
✓ Secure: Single valid policy detected

waitrose.com →

DMARC Record: _dmarc.waitrose.com
v=DMARC1; p=quarantine; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com,mailto:dmarc-ruf@dmarc-johnlewis.co.uk; fo=1; rua=mailto:dmarc_rua@emaildefense.proofpoint.com,mailto:dmarc-rua@dmarc-johnlewis.co.uk
✓ Secure: Single valid policy detected