dmarc record audit derived

{
  "input": {
    "body": {
      "domain": "example.test",
      "record": "v=DMARC1; p=quarantine; sp=none; pct=25; rua=mailto:dmarc@reports.vendor.test; adkim=s; ri=86400; policy=strict"
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "tags": {
        "p": "quarantine",
        "v": "DMARC1",
        "ri": "86400",
        "sp": "none",
        "pct": "25",
        "rua": "mailto:dmarc@reports.vendor.test",
        "adkim": "s",
        "policy": "strict"
      },
      "valid": false,
      "domain": "example.test",
      "limits": {
        "maxRecords": 2000,
        "maxFindings": 500,
        "maxHeaderBytes": 131072,
        "maxIncludeTree": 200,
        "spfLookupLimit": 10,
        "maxRecordLength": 4096,
        "spfVoidLookupLimit": 2
      },
      "passed": false,
      "policy": "quarantine",
      "complete": true,
      "findings": [
        {
          "tag": "pct",
          "code": "POLICY_APPLIED_TO_PART_OF_MAIL",
          "detail": "The record declares pct=25, so the policy applies to 25% of failing mail and the rest is treated as p=none. A rollout left here is not the policy it appears to be."
        },
        {
          "tag": "sp",
          "code": "SUBDOMAIN_POLICY_WEAKER",
          "detail": "The record declares p=quarantine and sp=none, so a subdomain is treated more leniently than the organisational domain. Anything spoofing a subdomain gets the weaker treatment."
        },
        {
          "tag": "rua",
          "code": "REPORTING_TO_EXTERNAL_DOMAIN",
          "detail": "The rua tag sends reports to reports.vendor.test, which is outside example.test. That requires reports.vendor.test to publish a record authorising it, and without one no reports are sent at all."
        }
      ],
      "percentage": 25,
      "request_id": "example-request",
      "service_id": "dmarc_record_audit",
      "assumptions": [
        "Nothing resolves DNS. The record is supplied, so an arbitrary domain can be audited without widening any egress.",
        "A pct below 100 is reported because the tag applies to quarantine and reject and never to reporting, so a rollout left part way is routinely read as being further along than it is.",
        "Reporting to a domain other than the one being audited is reported, because that needs an authorising record at the destination and without one no reports are sent at all."
      ],
      "limitations": [
        "The record supplied. Whether it is published, whether reports are actually received, and what any receiver does with the policy are outside this. Not a security assessment.",
        "valid is true only when the record parsed, every tag was recognised, and nothing was left unexamined."
      ],
      "observed_at": "2026-10-02T00:00:00.000Z",
      "not_examined": [],
      "finding_count": 4,
      "spf_alignment": "r",
      "dkim_alignment": "s",
      "service_version": "1.0.0",
      "findings_by_code": {
        "TAG_NOT_RECOGNISED": 1,
        "SUBDOMAIN_POLICY_WEAKER": 1,
        "REPORTING_TO_EXTERNAL_DOMAIN": 1,
        "POLICY_APPLIED_TO_PART_OF_MAIL": 1
      },
      "subdomain_policy": "none",
      "forensic_reporting": null,
      "aggregate_reporting": "mailto:dmarc@reports.vendor.test"
    }
  }
}