mail authentication coherence audit derived

{
  "input": {
    "body": {
      "spf": "v=spf1 include:_spf.vendor-a.test a mx +all",
      "dmarc": "v=DMARC1; p=reject; aspf=s; adkim=s",
      "domain": "example.test",
      "dkim_selectors": [
        {
          "record": "v=DKIM1; k=rsa; t=y; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1234QIDAQAB",
          "selector": "rollout2026"
        },
        {
          "record": "v=DKIM1; k=rsa; p=",
          "selector": "retired2024"
        }
      ],
      "sending_subdomains": [
        "mail.example.test",
        "notifications.example.test"
      ]
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "domain": "example.test",
      "limits": {
        "maxRecords": 2000,
        "maxFindings": 500,
        "maxHeaderBytes": 131072,
        "maxIncludeTree": 200,
        "spfLookupLimit": 10,
        "maxRecordLength": 4096,
        "spfVoidLookupLimit": 2
      },
      "passed": false,
      "policy": "reject",
      "coherent": false,
      "complete": true,
      "findings": [
        {
          "code": "REJECT_POLICY_WITH_NO_USABLE_DKIM",
          "detail": "The policy is p=reject and no supplied selector carries a usable key outside testing mode. Every message then depends on SPF alignment alone, and the SPF record ends in +all rather than -all. Anything..."
        },
        {
          "code": "ENFORCING_POLICY_WITH_PERMISSIVE_SPF",
          "detail": "The policy is p=reject and the SPF record ends in +all, which authorises every host on the internet. SPF then always passes, so the policy enforces nothing through SPF."
        },
        {
          "code": "STRICT_SPF_ALIGNMENT_WITH_SUBDOMAIN_SENDERS",
          "detail": "The policy declares aspf=s, so the envelope domain must equal example.test exactly. Mail sent from mail.example.test, notifications.example.test does not align under SPF, and only DKIM can carry it."
        }
      ],
      "request_id": "example-request",
      "service_id": "mail_authentication_coherence_audit",
      "assumptions": [
        "Every finding here needs two or three records read together, which is why it exists alongside the single-record audits: no one record is wrong, and the combination does not work.",
        "A selector is usable only when it carries a public key and is not in testing mode, because a selector asking receivers to ignore failures cannot contribute to alignment however correctly it signs.",
        "Strict alignment is reported against the sending subdomains the caller lists, since that is the only way to know which senders exist. Without the list nothing about subdomain senders is assessed."
      ],
      "limitations": [
        "The records supplied. Nothing resolves DNS, no message is evaluated, and what any particular receiver does is outside this. Not a security assessment or a deliverability prediction.",
        "coherent is true only when every record was supplied and no combination of them was found to defeat itself."
      ],
      "observed_at": "2026-10-02T00:00:00.000Z",
      "not_examined": [],
      "finding_count": 6,
      "spf_alignment": "s",
      "dkim_alignment": "s",
      "selector_count": 2,
      "service_version": "1.0.0",
      "findings_by_code": {
        "SUBDOMAIN_MAIL_CANNOT_PASS": 1,
        "ENFORCING_WITHOUT_VISIBILITY": 1,
        "REJECT_POLICY_WITH_NO_USABLE_DKIM": 1,
        "ENFORCING_POLICY_WITH_PERMISSIVE_SPF": 1,
        "STRICT_SPF_ALIGNMENT_WITH_SUBDOMAIN_SENDERS": 1,
        "STRICT_DKIM_ALIGNMENT_WITH_SUBDOMAIN_SENDERS": 1
      },
      "subdomain_policy": "reject",
      "spf_all_qualifier": "+",
      "usable_selector_count": 0,
      "sending_subdomain_count": 2
    }
  }
}