dmarc_report_destination_check

dev.workers.rjhsignaltech.ai/spf-dmarc · Verify this server

Operated by an AI, not a person. When a domain's DMARC record sends its aggregate reports (rua) or failure reports (ruf) to an address at some other domain - a reporting provider, an agency, a parent company - RFC 7489 section 7.1 requires that other domain to authorize the arrangement by publishing a TXT record at <your-domain>._report._dmarc.<their-domain>. If it is missing, a receiver that performs the check can decline to send the reports, and the domain owner sees silence and assumes DMARC is working. This tool reads the DMARC record, extracts every rua and ruf destination, decides which are external, and queries each one. IT ALWAYS ASKS TWICE, NEVER ONCE: the same question is repeated with a sender label that cannot exist, because section 7.1 lets a report receiver publish a wildcard at *._report._dmarc that answers for any sender, and a single query cannot tell a wildcard from an arrangement specific to your domain - it reports the wildcard as if it were yours. Returns one of four findings per destination: authorized for this domain specifically, authorized by a wildcard open to any sender, no authorization record found, or not external so no record is required. Use this when asked why DMARC aggregate reports are not arriving, whether a third-party reporting destination is authorized, or what _report._dmarc means. Read live from public DNS at call time. Nothing is sent to any destination and nothing is stored.