spf dkim dmarc record checker

Audit SPF, DKIM and DMARC TXT records offline against RFC 7208, RFC 8301 and DMARCbis (RFC 9989), with a letter grade and exact fixes.

Check a domain's SPF, DKIM and DMARC records offline against RFC 7208, RFC 6376/8301 and the new DMARC standard RFC 9989 (DMARCbis). Paste the TXT records (dig output or your DNS host's view) into a file and get a graded report covering duplicate SPF records, the 10-lookup limit, +all/?all/ptr, weak or test-mode DKIM keys, missing or p=none DMARC, removed tags such as pct, missing reporting and external report authorization, with exact fixes. Use when someone asks "why is my email going to spam?", "is my DMARC right?" or "set up SPF/DKIM/DMARC".

What it does

• Runs entirely offline in standard-library Python (no network, no credentials, writes only inside the working folder).
• Ships with examples, unit tests (run on Python 3.8 / 3.9 / 3.13) and a references/sources.md citing the official specs used.
• Exit codes: 0 = clean / aligned, 1 = findings, 2 = bad input — ready for CI and agent loops.

Who it's for

Security-minded developers, MSPs, small-business IT, compliance leads and IR analysts who want a repeatable offline check their agent can run.

Not legal advice / limits

See the skill's references/sources.md and Known Limitations below. Compliance-flavored output is a draft for counsel, not a certification.