Question 1

What does this DNS security audit check?

Accepted Answer

It runs 12 checks: DMARC, SPF, DKIM, MX, MTA-STS, TLS-RPT, BIMI, DNSSEC, CAA, DANE, nameservers, and Certificate Transparency. Each one reports pass, warning, fail, not configured, or not checked with the specific finding and a copy-paste fix where one applies.

Question 2

What is RFC 9989, and is it the same thing as DMARCbis?

Accepted Answer

RFC 9989 is the core DMARC protocol, published May 2026 on the IETF Standards Track. It does not stand alone: RFC 9990 covers aggregate reporting and RFC 9991 covers failure reporting. All three obsolete RFC 7489. RFC 9989 also obsoletes RFC 9091, and RFC 9991 updates RFC 6591. RFC 9989 introduces the DNS tree walk and the psd= and t= tags, brings np= in from RFC 9091, and removes the pct, rf, and ri tags. DMARCbis was the IETF working group's name for the revision effort, so the two names refer to the same work. Now that it is published, the standard is RFC 9989. This tool assesses your record against it.

Question 3

Is this tool free?

Accepted Answer

Yes. It is free, needs no account, and is open source.

Question 4

What is the most important DNS record for email security?

Accepted Answer

DMARC with a policy of reject is the highest-impact change. Move to p=quarantine and then p=reject only after the aggregate reports stop showing new legitimate senders and every one of them aligns, and sign all mail with DKIM first. RFC 9989 says a domain at p=reject must not rely on SPF alone, and that domains whose users post to mailing lists should not publish p=reject. SPF and DKIM provide the underlying authentication that DMARC enforces.

DNS & Email Security Audit

Audit results

What to do

What's unusual

Draft standards

Email services (detected from DNS records)

Your email platform