DMARC Validation Report

Introduction:

Domain-based Message Authentication, Reporting and Conformance (DMARC) augments SPF and DKIM by defining how a receiving server should treat mail that fails authentication while giving domain owners aggregate feedback. It links the visible From address with the authenticated envelope and header paths, protecting brands from look-alike phishing attempts.

This tool lets you enter any public-facing domain and immediately retrieves its _dmarc TXT record through a privacy-preserving DNS-over-HTTPS request. A lightweight reactive engine parses each tag, evaluates policy strength, and presents pass / fail checks so you can strengthen enforcement in seconds.

Security teams use the report when onboarding new sending services, rotating infrastructure, or auditing clients’ email posture. *Incomplete policies may cause legitimate mail to land in spam or expose recipients to spoofing attacks.*

Technical Details:

1. Concept Overview

DMARC policies reside in DNS and declare the required alignment between SPF, DKIM and the visible sender. Core tags include v (version), p (policy), pct (sample rate), and rua (aggregate report URI). Recipients combine these directives with local authentication results to decide whether to deliver, quarantine, or reject a message.

2. Lookup & Evaluation Process

1. Compose FQDN: _dmarc.<domain>.
2. Query the record via DNS-over-HTTPS.
3. Concatenate multi-string answers into one TXT payload.
4. Split on semicolons, building a tag → value map.
5. Apply compliance rules:
   
   • v = DMARC1
   • p ∈ none | quarantine | reject
   • pct = 100 or absent
   • rua present for feedback

3. Policy Semantics

Moving from none to quarantine or reject gradually eliminates spoofed mail but demands complete alignment across every authorised sender.

4. Worked Example

5. Assumptions & Limitations

• TXT record must not exceed 255 × 255 bytes; large policies are concatenated.
• Only the first DMARC record is evaluated; multiple records break compliance.
• DNS-over-HTTPS latency may vary with resolver location.
• Tool ignores ruf forensic reports for privacy reasons.

6. Edge Cases & Error Sources

• Transient NXDOMAIN when authoritative nameservers fail.
• Malformed tags missing = separators.
• CNAME indirection that hides the _dmarc label.
• Non-ASCII mailbox in rua URI.

7. Scientific Validity & References

Based on RFC 7489 (DMARC) and RFC 8461 (MTA-STS) interoperability notes, plus industry reports by M3AAWG and the Global Cyber Alliance.

8. Privacy & Compliance

No email content or personal data is processed; only public DNS records are queried, aligning with GDPR recital 26 on publicly available information.

Step-by-Step Guide:

Follow these steps to analyse any domain’s DMARC posture.

1. Enter the target domain in the Domain field.
2. Click Validate DMARC and wait for the reactive engine to fetch data.
3. Review the raw record string for obvious typos.
4. Read individual tag values in the table to confirm intent.
5. Use the checklist to spot missing reports or weak policies, then update DNS accordingly.

FAQ:

Glossary:

DMARC

Email-authentication policy published in DNS.

DoH

DNS-over-HTTPS encrypted query transport.

Aggregate Report

Daily summary of authentication results.

Alignment

Match between header and envelope domains.

Policy Tag

p directive defining receiver action.