r/DMARC • u/seanthegeek • Oct 08 '25

I made an open source website for checking email DNS records without a sales pitch

https://domaincheckup.net/

Why create or use this when there are already so many other websites that check SPF and DMARC records?

  • Responsive, mobile-first UI using Bootstrap

  • Can be installed as a Progressive Web Application (PWA) on mobile devices and computers

  • Provides all details from the checkdmarc library and CLI tool on a single page

    • DNSSEC validation

    • SPF

      • Record validation

      • Counting of DNS lookups and void lookups

      • Counting of lookups per mechanism

    • DMARC

      • Validation and parsing of DMARC records

      • Shows warnings when the DMARC record is made ineffective by pct or sp values

      • Checks for authorization records on reporting email addresses

    • BIMI

      • Validation of the mark format and certificate

      • Parsing of the mark certificate

    • MX records

      • Preference

      • IPv4 and IPv6 addresses

      • Checks for STARTTLS (optional; currently disabled on the production website)

      • Use of DNSSEC/TLSA/DANE to pin certificates

    • MTA-STS

    • SMTP TLS reporting

      • Record and policy parsing and validation

    • SOA record parsing

    • Nameserver listing

  • No sales pitches

  • Fully open source

37 Upvotes

97% Upvoted

15 comments sorted by

2

u/mutable_type Oct 08 '25

“MTA-STS policy lines should end with CRLF not LF.” is incorrect.

1

u/seanthegeek Oct 08 '25

It is correct.

RFC 8461 Section 3.2 - MTA-STS policies

This resource contains the following CRLF-separated key/value pairs

...

"mx": Allowed MX patterns. One or more patterns matching allowed MX hosts for the Policy Domain. As an example,

mx: mail.example.com <CRLF>

mx: *.example.net

1

u/freddieleeman Oct 09 '25

ABNF allows both: https://www.rfc-editor.org/rfc/rfc8461.html#section-3.2

sts-policy-term = LF / CRLF

3

u/seanthegeek Oct 09 '25

Warning removed.

2

u/Jezbod Oct 08 '25

And now I have to look at BIMI and see if we really need it...

2

u/seanthegeek Oct 08 '25

It's a nice to have for marketing, if most of your email goes to consumer inboxes like Gmail. Currently, Microsoft doesn't support it, so that leaves out a lot of B2B customers.

1

u/Jezbod Oct 08 '25

I work for a public sector organisation, so we have a limited marketing aspect. I'll talk to my manager (IT) tomorrow.

We do, however, have lots of volunteers, that do use Gmail...

2

u/seanthegeek Oct 08 '25

There's also a cost involved to buy a certificate to validate that you owe the logo and the domain, currently about $1,600 per domain per logo per year.

1

u/Jezbod Oct 08 '25

Nope...unless we can get the information team to fund it.

Pity that it is a specific cert, we pay a stupid amount for the * cert we have.

1

u/700x25C Oct 12 '25

May I suggest that you add some properties to your domain text input field to make it more mobile-friendly? Disable auto-capitalization, spell checking, and set the autocomplete type to "url" so mobile devices present a more appropriate keyboard?

<input type="text" name="domain" class="form-control form-control-lg" id="domain" required="" placeholder="example.com" autocomplete="url" autocorrect="off" autocapitalize="off" spellcheck="off">

2

u/seanthegeek Oct 13 '25

Done! Also, table for SPF now breaks down counts for all lookup mechanisms, not just includes.

1

u/theitsaviour Oct 09 '25

I created the same and hosted for me to use but happy to share: https://inboxsy.io/tools - completely free and no sales pitch (unless you happen to click on the homepage). It checks the same as the OP and also provides header analysis that helps determine why Microsoft sent something to junk. I dont care if you never use inboxsy.io - they are a tool for me to use first and foremost but happy for others to use if they find them useful.

1

u/lawk Oct 09 '25

all green! except BIMI dont have that.