DMARC record parser

curl -X POST https://163-123-236-68.sslip.io/api/tools/dmarc-record-parser \
  -H "Content-Type: application/json" \
  -d '{"record":"v=DMARC1; p=reject; rua=mailto:dmarc@example.com; ruf=mailto:forensics@example.com; fo=1; adkim=s; aspf=s"}'

{
  "tool": "dmarc-record-parser",
  "input": {
    "record": "v=DMARC1; p=reject; rua=mailto:dmarc@example.com; ruf=mailto:forensics@example.com; fo=1; adkim=s; aspf=s"
  },
  "result": {
    "verdict": {
      "tone": "success",
      "headline": "A valid DMARC record: p=reject",
      "summary": "A receiver that honours this rejects failing mail outright. That is what this text asks for; whether it is published anywhere is a separate question."
    },
    "findings": [
      {
        "id": "nothing-was-looked-up",
        "severity": "info",
        "title": "Nothing here was looked up",
        "detail": "This reads the text in the box and makes no DNS query at all, so it can tell you whether the record is written correctly but not whether it is published, or whether something else is published instead. The DMARC checker answers that for a domain."
      },
      {
        "id": "subdomains-inherit-the-policy",
        "severity": "info",
        "title": "Subdomains follow the same policy",
        "detail": "There is no \"sp\" tag, and RFC 7489 §6.3 says that when it is absent the \"p\" policy MUST be applied for subdomains too. Leaving it out is not a gap: mail claiming to be from any subdomain is already covered by \"p=reject\"."
      },
      {
        "id": "external-reports-need-authorisation",
        "severity": "info",
        "title": "An outside report address needs its own record",
        "detail": "If a report address is on a different domain from the one publishing this record, RFC 7489 §7.1 requires that other domain to publish \"<your-domain>._report._dmarc.<their-domain>\" agreeing to receive them, or a receiver skips the address. A pasted value does not say which domain publishes it, so that cannot be checked here."
      },
      {
        "id": "failure-reporting-options-set",
        "severity": "info",
        "title": "Failure reports are asked for specifically",
        "detail": "\"fo=1\" picks which failures earn a report, from the four values RFC 7489 §6.3 defines. §6.3 also says report generators MAY choose to adhere to the requested options, so this is a request rather than a setting."
      },
      {
        "id": "forensic-reports-requested",
        "severity": "info",
        "title": "This record asks for forensic reports",
        "detail": "A \"ruf\" address asks receivers for per-message failure reports, which can carry parts of a real message — RFC 7489 §6.3 notes a receiver generates none at all without the tag, and whether any receiver sends them to you is their decision, not something the record settles."
      },
      {
        "id": "strict-alignment-requested",
        "severity": "info",
        "title": "Strict alignment is asked for on DKIM and SPF",
        "detail": "In strict mode RFC 7489 §6.3 requires the DKIM and SPF domain to match the From domain exactly, so mail signed or sent as a subdomain stops aligning and starts failing DMARC. It is worth confirming every sender uses the exact domain first."
      },
      {
        "id": "record-is-valid-dmarc",
        "severity": "pass",
        "title": "This text is a valid DMARC record",
        "detail": "It starts with \"v=DMARC1\" and carries a \"p\" tag, which is what RFC 7489 §6.3 requires of a policy record, and every tag in it matches §6.4's grammar. A receiver that honours this rejects failing mail outright."
      },
      {
        "id": "policy-will-be-enforced",
        "severity": "pass",
        "title": "Failing mail is asked to be refused",
        "detail": "A receiver that honours this rejects failing mail outright. RFC 7489 §6.3 says that applies to this domain and to its subdomains, unless an \"sp\" tag sets a different one for them."
      }
    ],
    "parts": [
      {
        "kind": "record",
        "title": "The record, as a receiver reads it",
        "value": "v=DMARC1; p=reject; rua=mailto:dmarc@example.com; ruf=mailto:forensics@example.com; fo=1; adkim=s; aspf=s",
        "note": "Publish this as a TXT record at \"_dmarc.\" plus your domain, not at the domain itself.",
        "at": {
          "name": "_dmarc",
          "type": "TXT"
        }
      },
      {
        "kind": "table",
        "title": "Every tag, explained",
        "columns": [
          "Tag",
          "In this record",
          "What it means"
        ],
        "mono": [
          0,
          1
        ],
        "rows": [
          [
            "v",
            "DMARC1",
            "The record is DMARC version 1 — the only version there is."
          ],
          [
            "p",
            "reject",
            "A receiver that honours this rejects failing mail outright."
          ],
          [
            "sp",
            "(not set — subdomains follow \"p\")",
            "The policy applied to subdomains instead of \"p\"."
          ],
          [
            "pct",
            "(not set — default 100)",
            "The percentage of failing mail the policy is applied to; the rest gets one level lighter."
          ],
          [
            "rua",
            "mailto:dmarc@example.com",
            "Where daily aggregate reports about this domain are sent."
          ],
          [
            "ruf",
            "mailto:forensics@example.com",
            "Where per-message forensic reports are sent, if the receiver supports them."
          ],
          [
            "adkim",
            "s",
            "Strict: the DKIM signature’s domain must match this domain exactly."
          ],
          [
            "aspf",
            "s",
            "Strict: the SPF domain must match this domain exactly."
          ],
          [
            "fo",
            "1",
            "Which failures earn a forensic report: \"0\" only when everything failed, \"1\" when anything did, \"d\" for a broken DKIM signature, \"s\" for a failed SPF check (RFC 7489 §6.3)."
          ],
          [
            "ri",
            "(not set — default 86400)",
            "How many seconds apart aggregate reports are asked for. Daily is the default and the only interval a receiver must support (RFC 7489 §6.3)."
          ],
          [
            "rf",
            "(not set — default \"afrf\")",
            "The format asked for in forensic reports; \"afrf\" is the only one RFC 7489 §6.3 supports."
          ]
        ],
        "note": "Every tag RFC 7489 §6.3 defines is listed, set or not — a tag this record leaves out takes the default shown beside it."
      }
    ],
    "limits": [
      "No lookup is made. This says whether the text is valid DMARC, not whether it is live: a record that parses here still does nothing until it is published at \"_dmarc.\" plus your domain, and something different may be published there already. Check that with the DMARC checker.",
      "A report address on a domain other than the one publishing the record has to be authorised by that other domain (RFC 7489 §7.1). A pasted value does not say which domain publishes it, so that cannot be checked here either.",
      "The record states what you are asking receivers to do. It cannot say how much of your own legitimate mail would fail the policy — only an aggregate report from a real mail stream shows that."
    ]
  }
}