321 stars · Apache-2.0 · 6.0.1 (2026-09-04) · Track this in Rising ↗
Checks a domain's SPF, DKIM, DMARC and MTA-STS records in seconds — whether the newsletter you have not built yet is even allowed to arrive.
Radar check
What we found when we opened it. Every bar is one fact, with its date.
Last code pushed 13 Oct 2026, 14 days before this check.
Latest release 6.0.4 on 13 Oct 2026.
Public since December 2017, a little over 8 years.
323 stars and 101 forks.
20 commits and 4 new issues in the last 90 days.
36 contributors. 20 pull requests merged in 90 days.
No security policy file says how to report a problem. No published security advisories.
How the bars are scored
- Alive. Days since the last code push: a week or less 100, a month 90, three months 70, six months 50, a year 30, eighteen months 15, older 0.
- Releases. Age of the latest GitHub release, on a similar scale; no bar when the project publishes no releases.
- Maturity. Age of the project: eight years 100, five 90, three 70, two 55, one 40, six months 25, younger 10.
- Adoption. Stars on a log scale: 100,000 stars is 100, 10,000 is 80, 1,000 is 60, 100 is 40.
- Activity. Commits in the last 90 days: 300 or more 100, 100 85, 30 65, 10 45, any 25.
- Community. People who have contributed: 100 or more 100, 30 80, 10 60, 5 40, 2 25, one 10.
- Security. A published security policy 80, none 40; published advisories are listed, not scored.
Checked by Repo Radar on 25 Oct 2026 from the repository on GitHub. Covered in Edition 8.
▶Repo detailsthe review · specs · pros & cons · install
What it does
You give it a domain name and it reads that domain's public DNS records. DNS is the address book of the internet, and it holds small text records that say who may send mail for a domain. It checks SPF, DKIM, DMARC and MTA-STS, which are the four records mail providers look at. It also looks up the mail servers themselves and reports whether they answer. The output comes as readable text or as JSON, so a scheduled job can watch for a record that breaks. Each failure is explained rather than just marked red. Version 6.0.3 landed on 21 September 2026 and needs Python 3.10 or newer. It does not change anything: it reports, and the repair is done by hand at the domain registrar.
Why it matters
Who it suits. Anyone about to send bulk email from their own domain for the first time, and anyone whose newsletter open rate dropped without explanation. It also suits a small team that wants a nightly check so a broken record is noticed in hours rather than months. Skip it if all mail goes through a hosted provider that manages the records and reports on them already.
Verdict. Worth ten minutes before the first campaign, and worth a scheduled run afterwards. The failure it catches is silent, which is what makes it valuable: the sending dashboard reports success while the messages land in spam. Run it against two or three well-run domains as well, to see what a correct setup looks like. Pair it with parsedmarc from the same author once DMARC reports start arriving, and with Mailpit for testing the messages themselves.
Summary (Key Points)from the README
Key features
- Multiple interfaces: Offers API, command line, and web application access, and can test multiple domains at once.
- Machine-readable output: The CLI can print results as JSON or CSV.
- DNSSEC validation: Checks DNSSEC for the domains it tests.
- SPF analysis: Validates SPF records and counts DNS lookups and void lookups, both overall and per mechanism.
- DMARC parsing: Validates and parses DMARC records, warns when an sp value makes the policy ineffective, and flags use of the pct, rf, and ri tags removed in RFC 9989.
- Reporting authorization: Checks for authorization records on DMARC reporting email addresses.
- BIMI checks: Validates the mark format and certificate against the Minimum Security Requirements for Issuance of Mark Certificates, and parses the mark certificate.
- MX and transport testing: Reports MX preference and IPv4 and IPv6 addresses, with optional STARTTLS and TLS testing via --check-mx-tls, plus DANE/TLSA certificate pinning.
- MTA-STS and TLS reporting: Parses and validates MTA-STS and SMTP TLS reporting records and policies.
Important
- Single maintainer: The README states the project is maintained by one developer and asks users to consider sponsoring the work.
- Optional deeper testing: STARTTLS and TLS checks run only when you pass --check-mx-tls.
- Docker needs a local build: The README shows building the image yourself with docker build before running it; it does not describe a pre-built image.
- Standards-dependent warnings: The pct/rf/ri warnings follow RFC 9989, so results depend on that standard's current rules.
Written by an AI model from the project’s README; not part of the review, and it can be wrong.
- It works against any domain, including ones you do not control, so comparison is easy.
- JSON output makes it simple to run on a schedule and alert on a change.
- The explanations are readable by someone who has never edited a DNS record.
- It only diagnoses. The repair is manual, slow to take effect, and easy to get subtly wrong.
- Correct records are necessary but not sufficient. Sending reputation and list quality still decide the outcome.
- At 321 stars it is a small project with few maintainers. Treat it as a tool to run, not as a dependency to build on.
# needs Python 3.10 or newer pip install checkdmarc checkdmarc example.com
