AlienVault OTX Pulse Lookup

Perform deep technical threat intelligence gathering by querying the Open Threat Exchange (OTX). Correlate indicators of compromise (IoCs), parse structured STIX/TAXII pulses, and analyze real-time telemetry for IPv4/IPv6 addresses, domains, file hashes, and URIs.

No signup

Instant results

100% free

What Is DMARC?

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is an email authentication protocol that builds on SPF and DKIM. It tells receiving mail servers how to handle emails that fail authentication checks, protecting your domain from spoofing and phishing attacks.

Why It Matters

Without DMARC, anyone can send email using your domain. DMARC prevents phishing and improves your domain's sender reputation with mailbox providers.

Common Mistakes

Using "p=none" indefinitely, missing rua tags, and failing to align subdomains are the top causes of audit failure.

SOURCE_IDENTITY

DKIM_SIGNATURE_OK

SPF_PASS

ALIGNMENT_MATCH

DMARC_ENGINE_V2

REJECT_POLICY

How It Works

Input Domain

Type your root or subdomain into the lookup tool above.

Click Check

Our scanners query global DNS records in real-time.

Review Results

Analyze syntax, policy mode, and alignment parameters.

Fix & Enforce

Follow our recommendations to reach p=reject status.

Policy Mode

Reads the p= tag from your DMARC TXT record and evaluates whether your domain enforces none (monitor only), quarantine (route to spam), or reject (block outright). Reject is recommended for full protection.

Report Config

Checks that your rua= (aggregate reports) and ruf= (forensic/failure reports) mailto addresses are published and reachable. Missing reporting tags means you get no visibility into who sends email as your domain.

Align Check

Inspects the adkim= and aspf= tags to determine whether your domain requires strict or relaxed alignment between the RFC5321.MailFrom, the DKIM d= domain, and the visible From header.

Syntax Validation

Parses the full DMARC record for illegal characters, duplicate tags, incorrect quoting, and other formatting errors that can cause receiving servers to silently ignore the record.

Subdomain Posture

Evaluates the sp= tag to determine how subdomains inherit or override the organizational domain policy. If sp= is missing, subdomains fall back to the parent p= tag which may leave them unprotected.

Enforcement Score

Combines policy strength, alignment mode, reporting coverage, and subdomain posture into a single letter grade (A+ through F) so you can quickly assess your domain's overall resistance to email spoofing.

Frequently Asked Questions

What is an AlienVault OTX Pulse?

An OTX Pulse is a structured collection of Indicators of Compromise (IoCs) created by the threat intelligence community. It typically represents a specific cyberattack, malware family, or APT campaign, containing associated IPs, domains, URLs, and file hashes.

How does OTX Lookup differ from standard reputation checks?

While a standard reputation check typically returns a binary malicious/benign verdict, an OTX Lookup returns rich contextual data. It provides the campaign context, adversary behavior (TTPs), and related infrastructure linked via the Pulse, enabling a more informed incident response.

Which types of observables can be queried?

The OTX API supports lookups for IPv4 and IPv6 addresses, domain names, hostnames, URIs/URLs, file hashes (MD5, SHA1, SHA256), and even CVEs to discover actively exploited vulnerabilities in the wild.

Can this tool identify zero-day threats?

While OTX is highly effective at identifying known campaigns rapidly shared by the community, it relies on crowdsourced reporting. Therefore, a true zero-day may not appear until the first researcher observes and publishes a Pulse detailing the novel IoCs.

How is the data structured for SIEM integration?

The tool outputs structured data that mirrors the OTX REST API payload, which can be easily transformed into STIX/TAXII formats or ingested directly via JSON to trigger automated SOAR playbooks and SIEM alerts.

What role does Passive DNS play in OTX lookups?

OTX aggregates Passive DNS (pDNS) telemetry, allowing analysts to see the historical IP addresses associated with a malicious domain over time. This is critical for uncovering hidden C2 nodes and analyzing Domain Generation Algorithm (DGA) behavior.

Is the threat data vetted for false positives?

OTX utilizes a combination of automated analysis and community voting to establish confidence. However, because it is an open platform, analysts should configure their ingestion pipelines to filter Pulses based on author reputation or corroborate findings with a secondary threat intel feed.

Related Security Tools

Perform an AlienVault OTX Lookup

Analyze IPs, domains, or hashes against the global Open Threat Exchange to uncover hidden campaigns and preemptively block malicious infrastructure.

Start Free Trial View Pricing