DKIM DMARC Validator

The DKIM DMARC Validator focuses on the domain-level signals that influence whether email passes authentication checks. It performs authoritative DNS lookups to retrieve the DMARC TXT record at _dmarc.domain, parses v=DMARC1, and interprets key parameters such as p (policy), sp, and pct. It also analyzes alignment settings adkim and aspf to determine whether DKIM or SPF alignment is required and whether non-aligned mail would be blocked under the domain's policy. The tool produces a structured assessment showing whether the domain is already compliant, or if policy transitions—for example from none to quarantine—are advisable based on observed signals.
As for DKIM, the validator can optionally query the DKIM public key for a given selector at selector._domainkey.domain. It reports whether a DKIM TXT record exists, the selector in use, and whether the key is in a format compatible with DKIM signing standards (DKIM1). If a selector is provided but the key is missing or misconfigured, the validator flags this as a prerequisite to address before full DKIM validation, and it suggests practical remediation such as creating or publishing the correct TXT record.
Outputs include an overall status (pass, warning, or fail) and granular signals: dmarc_record, dmarc_policy, dkim_status, spf_status, and a remediation guidance field. The remediation guidance translates technical findings into concrete steps suitable for security and deliverability teams, such as publishing a DMARC policy, adding or rotating DKIM keys, enabling DKIM alignment, or correcting domain-wide SPF records. The tool supports both quick checks and deeper audits suitable for pre-deployment readiness, ongoing monitoring, or post-incident validation.
Industry standards reference RFC 7489 for DMARC and RFC 6376 for DKIM, with compatibility for IDNA domain names. The validator is designed for integration into CI pipelines, security dashboards, or managed DNS workflows, providing machine-readable outputs alongside human-readable summaries. It does not process email headers or cryptographically verify a real message signature; instead it bases its conclusions on DNS data and policy interpretation to deliver actionable, auditable evidence for domain owners and operators.