uSend Docs
Tools

DMARC analyzer

Check a domain's DMARC, SPF, DKIM, BIMI, MTA-STS and TLS-RPT records.

The DMARC analyzer looks up a domain's mail authentication records and tells you what to fix. Open it in the dashboard under DMARC analyzer, type a domain and choose Check domain. It works for any domain, not only the ones you send from.

What it checks

  • DMARC at _dmarc (or the parent domain's record, which subdomains inherit), with the policy tags p, sp, pct, rua, ruf, adkim and aspf.
  • SPF on the domain: missing record, +all, no enforcing ending, too many lookups.
  • DKIM for the selector usend publishes.
  • BIMI at default._bimi. See BIMI.
  • MTA-STS (_mta-sts record and the policy file) and TLS-RPT (_smtp._tls).

Each finding is marked critical, warning, info or passed, and comes with how to fix it.

Safety

The analyzer only reads DNS, plus one HTTPS request for the MTA-STS policy at https://mta-sts.<domain>/.well-known/mta-sts.txt. That request has a short timeout, follows no redirects and refuses private or internal addresses.

API

Shell
curl -X POST https://api.usend.et/tools/dmarc-check \
  -H "Authorization: Bearer us_xxx" \
  -H "Content-Type: application/json" \
  -d '{"domain": "acme.com"}'

The call is limited to 30 per minute per organization. See the API reference for the response.