TamingDNS

Analyse a pasted block of raw email headers for spoofing and phishing tells. Input is the raw headers (everything up to the first blank line — "Show original" / "View source"); the message body is not required. Returns structured findings + a phishing verdict (likely_phishing/verify_sender/minor_concerns/legitimate/auth_incomplete) derived from SPF/DKIM/DMARC alignment (RFC 7489 §3.1), Microsoft composite-auth compauth reason codes (000/010 enforced failure, 601 intra-org implicit failure, 001 weak posture), ARC chain integrity (RFC 8617 §5.2), homoglyph / IDN look-alike From domains (Unicode UTS #39), header smuggling via duplicate singleton headers (RFC 5322 §3.6), display-name-as-address spoofing, hidden bidi/control characters (UAX #9), Received-chain timestamps running backward (RFC 5321 §4.4), link display-text-vs-href mismatches, originating-IP FCrDNS (RFC 8601), and RFC 8058 List-Unsubscribe deliverability posture (category:compliance, never moves the verdict). Findings include DMARC_FAILED, SPF_HARD_FAIL, DKIM_SIGNATURE_FAILED, COMPAUTH_EXPLICIT_FAILURE, COMPAUTH_INTRA_ORG_IMPLICIT_FAILURE, HOMOGLYPH_DOMAIN, DUPLICATE_HEADER, DISPLAY_NAME_SPOOFED_ADDRESS, RECEIVED_TIMESTAMPS_BACKWARD, URL_DISPLAY_MISMATCH, HIDDEN_CONTROL_CHAR, BRAND_IMPERSONATION, and more (registered in docs/finding-codes.md). `status` is the finding-severity aggregate; `verdict` is the authoritative phishing judgment; `analysis` carries the verdict object + per-mechanism authentication. For privacy the echoed `input` is a digest only (from / subject / message_id) — raw headers are never returned. Read-only.

Check default._bimi.<domain>: parses the BIMI record, validates the SVG Tiny-PS logo, inspects the VMC chain (expiry, EKU, SCT, issuer-accepted, SAN match, logotype hash), and verifies the DMARC prerequisite (p=quarantine/reject at pct=100 with no sp=none — the RFC 7489 reading Gmail and Apple Mail evaluate today). DMARCbis (RFC 9989) aware: t= is parsed into analysis.dmarc.t, t=y emits TESTING_MODE (warn under p=quarantine — bis receivers read it as none; info under p=reject), and a present pct= emits DEPRECATED_TAG (removed by RFC 9989 Appendix A.6, advisory only). Returns grade (A-F), structured findings, and an `analysis` block (logo/vmc/dmarc/provider_matrix). Read-only.

Check SMTP DANE / TLSA records for a domain (RFC 7672). Resolves the MX hosts (falls back to the apex when none), looks up the TLSA record at _25._tcp.<mx-host> over binary DoH, classifies each record (usage 0-3 / selector 0-1 / matching 0-2 per RFC 7671 §2.1), and confirms the answer carried the DNSSEC AD bit — DANE is meaningless without DNSSEC, so an unsigned TLSA answer is the dominant failure mode. Returns grade (A-F) with grade_reasons, a verdict (valid/valid_with_warnings/no_dnssec/not_configured/error), structured findings (DANE_NO_TLSA, DANE_TLSA_HOST_UNSIGNED, DANE_PKIX_TA_USED_WITHOUT_CHAIN, DANE_TLSA_EXACT_MATCH, DANE_PARTIAL_COVERAGE, DANE_TLSA_INVALID_USAGE/SELECTOR/MATCHING), and an `analysis` block (per-host TLSA records + DNSSEC status, the spec-compliance signals, and the MTA-STS cross-signal). DNS-only: it never opens a port-25 STARTTLS handshake, so it proves the TLSA records exist, are well-formed, and are DNSSEC-signed — never that they match the live cert (Hostinger and Cloudflare both block outbound 25). Read-only.

Look up a DKIM public key at <selector>._domainkey.<domain> and validate it. Detects key revocation (empty p=), RSA key length (KEY_TOO_SHORT below 1024, KEY_WEAK below 2048), SHA-1 hash deprecation, and t=y test mode. For selector1/selector2 it also checks a Microsoft 365 CNAME target carries the token Microsoft builds for the domain (M365_DKIM_CNAME_MISMATCH), even when no key resolves. Returns an `analysis` block with the per-key facts (key_type, key_bits, key_strength, revoked, test_mode, hash_algs, m365_cname). Read-only.

Check the _dmarc record for a domain with DUAL discovery: the RFC 7489 §6.6.3 organisational-domain ladder (what major receivers enforce today — grade/verdict anchor to it) AND the RFC 9989 §4.10 DNS Tree Walk (8-query cap, psd=n/y stop rules, fewest-labels org selection) into analysis.discovery {legacy, tree_walk, diverges}. When the two methods select different policy records or org domains, DISCOVERY_DIVERGENCE (warn) fires with a one-notch grade downgrade. Also DMARCbis tag-aware: t=/np=/psd= parsed into analysis.tags, removed tags (pct/rf/ri) emit DEPRECATED_TAG, t=y emits TESTING_MODE with a one-notch downgrade. Returns the grade (A-F) with grade_reasons, a verdict (enforced/partial/monitoring/monitoring_blind/invalid/not_configured), structured findings (NO_DMARC_RECORD, MULTIPLE_DMARC_RECORDS, INVALID_TAG, POLICY_NONE, POLICY_NONE_NO_RUA, PCT_BELOW_100, RUA_MISSING_UNDER_ENFORCEMENT, SP_NOT_ENFORCED, EXTERNAL_RUA_UNAUTHORIZED, DMARC_INHERITED_FROM_ORG, TESTING_MODE, DEPRECATED_TAG, DISCOVERY_DIVERGENCE), and an `analysis` block with the lookup ladder, discovery, source (self/org), org_domain, normalised tags, per-recipient RUA/RUF external-authorisation detail (RFC 7489 §7.1), and rua_unauthorised. Read-only.

Ask 14 public DoH resolvers in North and South America, Europe and Asia (Google, Cloudflare, Quad9, CIRA, Comcast, Mullvad, DNSPod, IIJ, DNS.SB and more) for one record type at one name, and report whether they agree. Use it after changing a record to see whether the change has spread. `resolvers[]` gives every resolver's answer (`values`, `ttl`, `status` agree / disagree / unavailable), so compare those with the value you published; `records[]` is the most common answer and `analysis.propagation_pct` the share of answering resolvers that gave it. `verdict` is consistent (all agree), absent (all agree there is no record), rotating (a resolver changed its own answer when asked again: load balancing), split_short_ttl (answers differ and every TTL is 300 s or less: CDN or GeoDNS), split (answers differ with no such explanation: finding RESOLVERS_DISAGREE, status warn) or incomplete (fewer than half answered: finding RESOLVERS_PARTIAL, status warn). Otherwise status is info: this tool reports data, not a grade. A timeout is never counted as "no record"; if no resolver answers, the result is a retriable DOH_TIMEOUT error. Not cached, so you can poll it; each call queries all 14 resolvers (twice when they disagree). Read-only.

Validate a domain's DNSSEC chain of trust. Pulls DS (at the parent), DNSKEY, and RRSIG over binary DoH, walks the chain zone-by-zone (root → TLD → domain) recomputing each DS digest against the published DNSKEYs (RFC 4034 §5.1.4), and cross-checks the AD bit across Cloudflare, Google, Quad9, and OpenDNS so a single resolver's caching can't mask a break. Returns grade (A-F) with grade_reasons, a verdict (signed/signed_no_ds/partial/unsigned/broken), structured findings (DNSSEC_UNSIGNED, DNSSEC_DS_MISSING_AT_PARENT, DNSSEC_DS_ALGORITHM_DEPRECATED, DNSSEC_DNSKEY_ALGORITHM_DEPRECATED, DNSSEC_RRSIG_EXPIRED, DNSSEC_BOGUS, DNSSEC_AD_BIT_MISSING), and an `analysis` block (the full chain-walk, the per-resolver validator matrix, NSEC3 iteration/opt-out, CDS/CDNSKEY publication, signing mode, root-anchor state). Unsigned is the common case and returns status "info" (DNSSEC is optional), not a failure; signed_no_ds (DNSKEY published, no DS at the parent yet) is treated by validators as unsigned and also returns "info"; a published-but-non-validating zone returns "fail". Read-only.

Audit a domain's DNS against what Google Workspace expects: MX to Google (smtp.google.com, or the legacy aspmx hosts Google still supports), SPF includes _spf.google.com, a DKIM key at the default google selector (google._domainkey), DMARC policy and rua=, MTA-STS, TLS-RPT and BIMI. Built from the same envelopes check_spf, check_dkim, check_dmarc, check_mx, check_mta_sts, check_tls_rpt and check_bimi return, so it never disagrees with them. `verdict` is configured / configured_with_issues / not_detected. A domain with no Google Workspace indicator (MX, SPF include, google DKIM key) returns only GWS_NOT_DETECTED (status info). A check that could not run is listed in GWS_CHECK_INCOMPLETE and its `analysis.checks[]` entry is `unknown`, never "missing". No key at the google selector is a warning, not a failure, because an admin can choose another prefix: call check_dkim with that selector. Findings include GWS_SPF_NO_GOOGLE_INCLUDE, GWS_SPF_INVALID, GWS_DKIM_DEFAULT_SELECTOR_NOT_FOUND, GWS_DKIM_KEY_WEAK, GWS_DMARC_MISSING, GWS_DMARC_NOT_ENFORCING, GWS_MX_NOT_GOOGLE, GWS_MTA_STS_MISSING, GWS_TLS_RPT_MISSING_UNDER_ENFORCE and more (registered in docs/finding-codes.md). Read-only.

Audit a domain's DNS against what Microsoft 365 expects: SPF includes spf.protection.outlook.com, DKIM selector1/selector2 (CNAME target and key), DMARC policy and rua=, MX to Microsoft 365 (*.mail.protection.outlook.com or *.mx.microsoft), MTA-STS, Autodiscover to autodiscover.outlook.com, TLS-RPT, BIMI, and the Teams SIP SRV records. Built from the same envelopes check_spf, check_dkim, check_dmarc, check_mx, check_mta_sts, check_tls_rpt and check_bimi return, so it never disagrees with them. `verdict` is configured / configured_with_issues / not_detected. A domain with no Microsoft 365 indicator returns only M365_NOT_DETECTED (status info). A check that could not run is listed in M365_CHECK_INCOMPLETE and its `analysis.checks[]` entry is `unknown`, never "missing". Findings include M365_SPF_NO_O365_INCLUDE, M365_SPF_INVALID, M365_DKIM_SELECTOR_MISSING, M365_DKIM_NO_KEY_AT_CNAME, M365_DKIM_CNAME_MISMATCH, M365_DMARC_MISSING, M365_DMARC_NOT_ENFORCING, M365_MX_NOT_M365, M365_MTA_STS_MISSING, M365_AUTODISCOVER_MISSING, M365_TLS_RPT_MISSING_UNDER_ENFORCE and more (registered in docs/finding-codes.md). Read-only.

Check MTA-STS (RFC 8461) for a domain: the _mta-sts TXT record (strict §3.1 selection — case-sensitive leading v=STSv1, exactly one record, required 1-32 alphanumeric id), the policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt fetched WITHOUT following redirects (§3.3), strict §3.2 policy validation (version/mode/max_age required, mx required unless mode none, max_age ≤ 31557600, duplicate keys first-wins), the policy-host X.509 certificate (§3.3 — an invalid cert means compliant senders fetch no policy), and live MX coverage against the mx: patterns (§4.1 — wildcards match exactly one leftmost label; coverage is all/partial/none, partial meaning strict senders skip the uncovered hosts per §5.1). Returns grade (A-F) with grade_reasons, a verdict (enforced/testing/reporting_only/invalid/not_configured), structured findings (MTA_STS_NO_TXT_RECORD, MTA_STS_RECORD_INVALID, MULTIPLE_MTA_STS_RECORDS, MTA_STS_POLICY_UNREACHABLE, MTA_STS_POLICY_REDIRECT, MTA_STS_POLICY_INVALID, MTA_STS_CERT_INVALID, MTA_STS_MODE_NONE, MTA_STS_MODE_TESTING, MTA_STS_MX_MISMATCH, MTA_STS_MX_PARTIAL_COVERAGE, MTA_STS_MAX_AGE_TOO_LOW), and an `analysis` block (record, policy incl. fetch_stage, cert, MX coverage detail, TLS-RPT/DANE cross-signals). Read-only.

Inspect a domain's MX / mail-routing posture. Resolves the apex MX RRset (priority-sorted), and for each host the A/AAAA addresses, PTR + forward-confirmed reverse DNS (FCrDNS), DANE TLSA at _25._tcp.<host>, IP-literal (RFC 5321 §5) and CNAME (RFC 2181 §10.3) violations, and the mail provider. Detects the null MX (RFC 7505), a null MX wrongly mixed with real MX, and the implicit MX via the apex A/AAAA when no MX exists (RFC 5321 §5). Probes the MTA-STS and TLS-RPT prerequisites over DNS (case-sensitive per RFC 8461/8460) with outage reported as unknown, never absence. Returns grade (A-F) with grade_reasons, a verdict (healthy/warnings/misconfigured/null_mx/no_mx/implicit_mx), structured findings (NO_MX_RECORD, MX_IMPLICIT_FALLBACK, NULL_MX, NULL_MX_WITH_OTHER, MX_POINTS_TO_IP, MX_POINTS_TO_CNAME, MX_HOSTNAME_UNRESOLVABLE, NO_PTR_RECORD, FCRDNS_MISMATCH, MX_IPV6_ONLY, MX_NO_TRANSPORT_SECURITY, MX_GATEWAY_RDNS_COSMETIC, MX_SINGLE_HOST, MX_DUPLICATE_HOST, MX_SHARED_PRIORITY, MX_MTA_STS_WITHOUT_TLS_RPT), and an `analysis` block (per-host enrichment incl. provider, ips with FCrDNS status, dane_tlsa, and the prerequisite probe results). DNSSEC AD is a UI-only signal, not gradeable through the DoH contract. Read-only.

Check the SPF record for a domain. Returns the raw record, grade (A-F), the terminal `all` qualifier (resolved through redirect= chains), structured findings (NEAR_LOOKUP_LIMIT, LOOKUP_LIMIT_EXCEEDED, PLUS_ALL_DANGEROUS, PTR_MECHANISM_DEPRECATED, etc.), and an `analysis` block with the expanded include/redirect tree and the RFC 7208 §4.6.4 lookup count. Read-only.

Check the TLS-RPT (SMTP TLS Reporting, RFC 8460) record at _smtp._tls.<domain>. Strict §3 classification: the record must BEGIN with the case-sensitive v=TLSRPTv1 tag, more than one such record means receivers treat TLS-RPT as not implemented, and rua= is required. Validates every rua= destination syntactically (mailto:/https:// — reachability is never probed), and detects the MTA-STS and DANE prerequisites over DNS (TLSA at _25._tcp of the lowest-preference MX) with outage reported as unknown, never as absence. Returns grade (A-F) with grade_reasons, a verdict (valid/partial/invalid/not_configured), structured findings (TLS_RPT_NO_RECORD, TLS_RPT_INVALID_VERSION, TLS_RPT_MULTIPLE_RECORDS, TLS_RPT_NO_RUA, TLS_RPT_RUA_INVALID_URI, TLS_RPT_NO_VALID_RUA, TLS_RPT_NO_ENFORCEMENT_POLICY), and an `analysis` block with parsed tags, per-URI rua validation detail, and the prerequisite probe results. Read-only.