DMARC Record Audit

Accepts

The payment requirements as published to the catalog. Read the live 402 before paying — a price here is a claim, not a quote.

[
  {
    "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
    "extra": {
      "name": "USD Coin",
      "version": "2"
    },
    "payTo": "0x25e8245f07d5e4873987293dad666afbe56a9608",
    "amount": "180000",
    "scheme": "exact",
    "network": "eip155:8453",
    "maxTimeoutSeconds": 60
  }
]

Extensions

{
  "bazaar": {
    "info": {
      "input": {
        "body": {
          "domain": "example.test",
          "record": "v=DMARC1; p=quarantine; sp=none; pct=25; rua=mailto:dmarc@reports.vendor.test; adkim=s; ri=86400; policy=strict"
        },
        "type": "http",
        "method": "POST",
        "bodyType": "json"
      },
      "output": {
        "type": "json",
        "example": {
          "tags": {
            "p": "quarantine",
            "v": "DMARC1",
            "ri": "86400",
            "sp": "none",
            "pct": "25",
            "rua": "mailto:dmarc@reports.vendor.test",
            "adkim": "s",
            "policy": "strict"
          },
          "valid": false,
          "domain": "example.test",
          "limits": {
            "maxRecords": 2000,
            "maxFindings": 500,
            "maxHeaderBytes": 131072,
            "maxIncludeTree": 200,
            "spfLookupLimit": 10,
            "maxRecordLength": 4096,
            "spfVoidLookupLimit": 2
          },
          "passed": false,
          "policy": "quarantine",
          "complete": true,
          "findings": [
            {
              "tag": "pct",
              "code": "POLICY_APPLIED_TO_PART_OF_MAIL",
              "detail": "The record declares pct=25, so the policy applies to 25% of failing mail and the rest is treated as p=none. A rollout left here is not the policy it appears to be."
            },
            {
              "tag": "sp",
              "code": "SUBDOMAIN_POLICY_WEAKER",
              "detail": "The record declares p=quarantine and sp=none, so a subdomain is treated more leniently than the organisational domain. Anything spoofing a subdomain gets the weaker treatment."
            },
            {
              "tag": "rua",
              "code": "REPORTING_TO_EXTERNAL_DOMAIN",
              "detail": "The rua tag sends reports to reports.vendor.test, which is outside example.test. That requires reports.vendor.test to publish a record authorising it, and without one no reports are sent at all."
            }
          ],
          "percentage": 25,
          "request_id": "example-request",
          "service_id": "dmarc_record_audit",
          "assumptions": [
            "Nothing resolves DNS. The record is supplied, so an arbitrary domain can be audited without widening any egress.",
            "A pct below 100 is reported because the tag applies to quarantine and reject and never to reporting, so a rollout left part way is routinely read as being further along than it is.",
            "Reporting to a domain other than the one being audited is reported, because that needs an authorising record at the destination and without one no reports are sent at all."
          ],
          "limitations": [
            "The record supplied. Whether it is published, whether reports are actually received, and what any receiver does with the policy are outside this. Not a security assessment.",
            "valid is true only when the record parsed, every tag was recognised, and nothing was left unexamined."
          ],
          "observed_at": "2026-10-02T00:00:00.000Z",
          "not_examined": [],
          "finding_count": 4,
          "spf_alignment": "r",
          "dkim_alignment": "s",
          "service_version": "1.0.0",
          "findings_by_code": {
            "TAG_NOT_RECOGNISED": 1,
            "SUBDOMAIN_POLICY_WEAKER": 1,
            "REPORTING_TO_EXTERNAL_DOMAIN": 1,
            "POLICY_APPLIED_TO_PART_OF_MAIL": 1
          },
          "subdomain_policy": "none",
          "forensic_reporting": null,
          "aggregate_reporting": "mailto:dmarc@reports.vendor.test"
        }
      }
    },
    "schema": {
      "type": "object",
      "$schema": "https://json-schema.org/draft/2020-12/schema",
      "required": [
        "input"
      ],
      "properties": {
        "input": {
          "type": "object",
          "required": [
            "type",
            "method",
            "bodyType",
            "body"
          ],
          "properties": {
            "body": {
              "type": "object",
              "required": [
                "record"
              ],
              "properties": {
                "domain": {
                  "type": "string",
                  "maxLength": 253
                },
                "record": {
                  "type": "string",
                  "maxLength": 4096
                },
                "require_reporting": {
                  "type": "boolean"
                }
              },
              "additionalProperties": false
            },
            "type": {
              "type": "string",
              "const": "http"
            },
            "method": {
              "enum": [
                "POST"
              ],
              "type": "string"
            },
            "bodyType": {
              "enum": [
                "json",
                "form-data",
                "text"
              ],
              "type": "string"
            }
          },
          "additionalProperties": false
        },
        "output": {
          "type": "object",
          "required": [
            "type"
          ],
          "properties": {
            "type": {
              "type": "string"
            },
            "example": {
              "type": "object"
            }
          }
        }
      }
    }
  }
}

Provenance

Seen in the source catalog

2026-10-04 08:41Z

Last indexed by Roundhouse

2026-10-05 00:20Z

Last enriched (probe, favicon, geo)

2026-10-05 16:46Z

x402 version

2

Max timeout

60s

Liveness probe

HTTP 0