4 ms·

Show HN: DMARC Checker

70 points by awulf 3y ago

akshayKMR 3y ago
Hey, this comes at a perfect time for me. I had posted my app on Betalist about a week ago and received a vulnerability report about incorrectly configured DMARC from a security researcher. I made the fix but wasn't confident about it. Shortly after, I received a couple more similar emails. With this tool, my first check failed, citing an invalid SPF record. (I had an extra `.` at the end of my TXT record). Now, the check shows all passing. I hope all is good now (emails are wild). From my limited understanding: SPF <- Should this server be sending emails for this domain? DKIM <- Was this email tampered with? DMARC <- What should I, as a recipient, do if SPF or DKIM fails? Thanks!
- awulf 3y ago
  I'm really happy to read that the app was able to help! Thanks for sharing.
- 1231232131231 3y ago
  DMARC itself contains some extra checks (alignment check).
petecog 3y ago
I've given it a go. I recommend also https://mxtoolbox.com/dmarc.aspx https://mxtoolbox.com/dmarc.aspx I have no affiliation.
- petecog 3y ago
  Great tool. Good comprehensive report. Keep up the great work. Hope it helps people. Email is such an amazing mess. Love and hate in equal measures
- bks 3y ago
  Seems that this tool actually validates your email and checks its alignment vs. just checking to see if there is a dmarc record on the domain.
RulerOf 3y ago
This is a really straightforward tool. Validating spf/dkim/dmarc by receiving an email strikes me as more effective than something that just looks at the DNS records. Thanks for sharing.
aeadio 3y ago
A simple reject policy is showing up as an error, despite validating fine with other DMARC checker apps like MX Toolbox, The From domain (...) has an invalid DMARC record. ... DMARC record found: v=DMARC1; p=reject; The DMARC check result is permerror. No explanation as to what permerror means. It might also be useful if the tool attempted to circumvent DNS caching, so users can try tests in succession after updating.
- awulf 3y ago
  There was a small bug in our DMARC record parser (it didn't like the semicolon at the end of the record). Sorry for that. Your DMARC record is definitely correct. The issue should be fixed now. Also, thanks for the idea about circumventing DNS caching. I'll look into adding that feature.
jenoer 3y ago
I don’t want to take away your spotlight, because it’s a nice project you launched, But I do want to point out to people that https://github.com/domainaware/checkdmarc https://github.com/domainaware/checkdmarc exists for quite a while. I use it often and have also integrated it in various automated tooling. (It also does not require handing out email addresses to strangers.)
bks 3y ago
Also check out - https://appmaildev.com/en/dkim https://appmaildev.com/en/dkim
bks 3y ago
Great tool, one bit of feedback on the log report. Perhaps you can highlight the passing line in the SPF record, I have about 100 of these "The ip4 mechanism does not match." and then a lot of "The include mechanism matches and produces a pass result." Maybe you can highlight the passing statement? - https://app.screencast.com/Hu5ybB6K3fd9R https://app.screencast.com/Hu5ybB6K3fd9R
- awulf 3y ago
  Thanks for the feedback, much appreciated! It looks like you've flattened your SPF record, causing a large number of log messages. I'll see what I can do to better highlight the line that produces the 'pass' result.
  - bks 3y ago
    Thank you - and would you be open to white labeling?
    - awulf 3y ago
      We've just launched the app this week. While white labeling is a possibility down the road, we're currently focused on refining it and gathering user feedback.
FerretFred 3y ago
Hey this is great! Just woken up, sipping tea in bed and have now got a fully validated DKIM/SPF setup. So easy... thank you!
ollybee 3y ago
This seems similar to https://www.mail-tester.com https://www.mail-tester.com which I use all the time to quickly diagnose mail issues
kunley 3y ago
Handy tool and looks better than a few similar I tried. Thank you!
yolo4553 3y ago
Hmm, am I seeing this correctly that the system does receive emails only via IPv4 and no IPv6? This would make the SPF check somewhat misleading as it only checks one option.
- awulf 3y ago
  You are correct, the mail server is currently configured to only receive emails via IPv4. This setup is not uncommon as most major email providers have IPv4-only MX records (with Gmail and Yandex Mail being rare exceptions that support IPv6). It might be a good idea to provide a different email address whose mail server explicitly requires IPv6. I'll think about it. Thanks for bringing it up.
wilg 3y ago
Very cool, thanks!

70 points by awulf 3y ago

Hey, this comes at a perfect time for me. I had posted my app on Betalist about a week ago and received a vulnerability report about incorrectly configured DMARC from a security researcher. I made the fix but wasn't confident about it. Shortly after, I received a couple more similar emails. With this tool, my first check failed, citing an invalid SPF record. (I had an extra `.` at the end of my TXT record). Now, the check shows all passing. I hope all is good now (emails are wild). From my limited understanding: SPF <- Should this server be sending emails for this domain? DKIM <- Was this email tampered with? DMARC <- What should I, as a recipient, do if SPF or DKIM fails? Thanks!

awulf 3y ago
I'm really happy to read that the app was able to help! Thanks for sharing.
1231232131231 3y ago
DMARC itself contains some extra checks (alignment check).

petecog 3y ago

I've given it a go. I recommend also https://mxtoolbox.com/dmarc.aspx https://mxtoolbox.com/dmarc.aspx I have no affiliation.

petecog 3y ago
Great tool. Good comprehensive report. Keep up the great work. Hope it helps people. Email is such an amazing mess. Love and hate in equal measures
bks 3y ago
Seems that this tool actually validates your email and checks its alignment vs. just checking to see if there is a dmarc record on the domain.

RulerOf 3y ago

This is a really straightforward tool. Validating spf/dkim/dmarc by receiving an email strikes me as more effective than something that just looks at the DNS records. Thanks for sharing.

aeadio 3y ago

A simple reject policy is showing up as an error, despite validating fine with other DMARC checker apps like MX Toolbox, The From domain (...) has an invalid DMARC record. ... DMARC record found: v=DMARC1; p=reject; The DMARC check result is permerror. No explanation as to what permerror means. It might also be useful if the tool attempted to circumvent DNS caching, so users can try tests in succession after updating.

awulf 3y ago
There was a small bug in our DMARC record parser (it didn't like the semicolon at the end of the record). Sorry for that. Your DMARC record is definitely correct. The issue should be fixed now. Also, thanks for the idea about circumventing DNS caching. I'll look into adding that feature.

jenoer 3y ago

I don’t want to take away your spotlight, because it’s a nice project you launched, But I do want to point out to people that https://github.com/domainaware/checkdmarc https://github.com/domainaware/checkdmarc exists for quite a while. I use it often and have also integrated it in various automated tooling. (It also does not require handing out email addresses to strangers.)

bks 3y ago

Also check out - https://appmaildev.com/en/dkim https://appmaildev.com/en/dkim

bks 3y ago

Great tool, one bit of feedback on the log report. Perhaps you can highlight the passing line in the SPF record, I have about 100 of these "The ip4 mechanism does not match." and then a lot of "The include mechanism matches and produces a pass result." Maybe you can highlight the passing statement? - https://app.screencast.com/Hu5ybB6K3fd9R https://app.screencast.com/Hu5ybB6K3fd9R

awulf 3y ago
Thanks for the feedback, much appreciated! It looks like you've flattened your SPF record, causing a large number of log messages. I'll see what I can do to better highlight the line that produces the 'pass' result.
- bks 3y ago
  Thank you - and would you be open to white labeling?
  - awulf 3y ago
    We've just launched the app this week. While white labeling is a possibility down the road, we're currently focused on refining it and gathering user feedback.

FerretFred 3y ago

Hey this is great! Just woken up, sipping tea in bed and have now got a fully validated DKIM/SPF setup. So easy... thank you!

ollybee 3y ago

This seems similar to https://www.mail-tester.com https://www.mail-tester.com which I use all the time to quickly diagnose mail issues

kunley 3y ago

Handy tool and looks better than a few similar I tried. Thank you!

yolo4553 3y ago

Hmm, am I seeing this correctly that the system does receive emails only via IPv4 and no IPv6? This would make the SPF check somewhat misleading as it only checks one option.

awulf 3y ago
You are correct, the mail server is currently configured to only receive emails via IPv4. This setup is not uncommon as most major email providers have IPv4-only MX records (with Gmail and Yandex Mail being rare exceptions that support IPv6). It might be a good idea to provide a different email address whose mail server explicitly requires IPv6. I'll think about it. Thanks for bringing it up.

wilg 3y ago

Very cool, thanks!