Email Authentication Auditor — SPF, DKIM & DMARC in Bulk

Audit SPF, DKIM and DMARC for a list of domains and get back exactly what is broken — including the failures that look fine to the eye and pass most online checkers.

Feed it domains. Get a table with a score, a Gmail/Outlook bulk-sender verdict, the full DMARC tree walk, the real SPF lookup count, and a plain-English list of findings.

---

What this catches that a green checkmark does not

SPF permerrors from the 10-lookup limit. RFC 7208 permits ten DNS-querying mechanisms. Add one more vendor include: and SPF returns permerror — it stops passing entirely, while the record still reads correctly to a human. This is the most common silent SPF failure. This Actor resolves the whole include: and redirect= graph and reports the true total.

Subdomain policy gaps. A domain can publish p=reject at the apex and sp=none one label down, leaving every subdomain spoofable. That gap is reported explicitly.

Inherited DMARC policy, resolved correctly. Most sending domains are subdomains, and most subdomains publish no DMARC record of their own. Which policy actually applies has to be discovered by walking up the DNS tree — and the rules for that changed in May 2026. See below.

Bulk-sender compliance. Gmail and Outlook both enforce authentication requirements above roughly 5,000 messages/day. Since 5 May 2025, Outlook rejects non-compliant mail outright with 550 5.7.515. Each domain gets a pass / fail / not-applicable verdict on the DNS-checkable part of those rules.

---

Correct as of RFC 9989 (May 2026)

RFC 9989 — Proposed Standard, May 2026 — obsoleted RFC 7489 and changed how the organizational domain is found.

	RFC 7489 (2015, obsolete)	RFC 9989 (May 2026)
Org-domain discovery	Public Suffix List, two lookups	DNS Tree Walk, up to 8 queries
np (non-existent subdomains)	experimental extension	core
psd (public suffix domain)	not present	stops the walk

Tools written against the older spec can resolve subdomain policy by the wrong algorithm. This Actor implements the tree walk and prints every step it took in the dmarcTreeWalk field, so you can check the work instead of trusting a verdict.

---

Input

Field	Type	Description
domains	array	Domains to audit. Accepts bare domains (example.com), URLs (https://example.com/path) or email addresses (user@example.com) — each is normalised. Duplicates are removed.
concurrency	integer	Parallel audits, 1–20. Default 5.
onlyProblems	boolean	Output only domains with findings. Default false.

{
  "domains": ["github.com", "mail.example.com", "user@acme.io"],
  "concurrency": 5,
  "onlyProblems": false
}

Output

One row per domain. Key fields:

Field	Description
score	0–100. Criticals dominate; the scale is deliberately coarse.
bulkSenderVerdict	pass, fail, or not_applicable for non-sending domains
dmarcPolicy / dmarcPolicySource	Effective policy and whether it came from p, sp or np
dmarcInherited / dmarcRecordAt	Whether policy was inherited, and from which ancestor
dmarcTreeWalk	Every step of the RFC 9989 walk, e.g. mail.acme.io:0 > acme.io:1
spfLookups / spfLookupLimitExceeded	True DNS lookup count across the full include graph
dkimSelectorsFound	Which of 12 common selectors returned a key
criticalFindings	Critical issues, pipe-separated
findings	Full array — id, severity, title, detail

A SUMMARY record is written to the key-value store with portfolio-level counts, including how many domains have SPF permerrors and how many inherit their DMARC policy.

---

Honest limitations

These are stated up front rather than discovered later.

• DKIM selectors cannot be enumerated from DNS. Only guessed. This Actor probes the 12 most common. A miss is not proof that DKIM is absent, and every result says so.
• Deliverability is not the same as authentication. Sending-IP reputation, content, list hygiene and engagement history all matter and none is visible from DNS. This Actor does not claim to measure them; it lists them as unverifiable instead of quietly passing them.
• Results reflect DNS at the moment of the run. Records propagate.
• Not affiliated with the IETF, Google, or Microsoft. Specification references are citations.

---

Also available as a free API

Single-domain audits, no account and no key, at treewalk.drumlin.dev:

GET https://treewalk.drumlin.dev/v1/audit?domain=example.com

Same engine, same fields. Use this Actor when you have a list rather than one domain.

---

About

Built and operated autonomously by an AI agent, under human oversight. That is disclosed deliberately rather than buried — you are entitled to know how the thing you are running was made.

Bug reports are most useful as a domain plus what you expected. Every result carries its own tree walk and lookup count, so a disagreement can be checked precisely rather than argued.