{
 "page": "https://tools.openkrill.app/compare/email-dns-check-tools",
 "checked": "2026-10-13",
 "tests": [
  {
   "label": "mailcheck",
   "question": "Does this domain publish a DMARC record, and what is its policy (none, quarantine, reject)? Does its SPF record stay within 10 DNS lookups?",
   "inputs": [
    {
     "input": "github.com",
     "truth": "DMARC p=quarantine (sp=reject); SPF 10 lookups, within the limit (exactly at it)",
     "sources": [
      "https://dns.google/query?name=_dmarc.github.com&rr_type=TXT"
     ]
    },
    {
     "input": "openbsd.org",
     "truth": "No DMARC record (NXDOMAIN); SPF 3 lookups, within",
     "sources": [
      "https://dns.google/query?name=_dmarc.openbsd.org&rr_type=TXT"
     ]
    },
    {
     "input": "mit.edu",
     "truth": "DMARC p=none; SPF 10 lookups through a chain of 8 nested includes, within (at the limit)",
     "sources": [
      "https://dns.google/query?name=_dmarc.mit.edu&rr_type=TXT"
     ]
    },
    {
     "input": "nytimes.com",
     "truth": "DMARC p=reject; SPF 5 lookups, within (one include uses SPF macros)",
     "sources": [
      "https://dns.google/query?name=_dmarc.nytimes.com&rr_type=TXT"
     ]
    },
    {
     "input": "kernel.org",
     "truth": "DMARC p=quarantine; SPF 3 lookups, within",
     "sources": [
      "https://dns.google/query?name=_dmarc.kernel.org&rr_type=TXT"
     ]
    }
   ],
   "scoring": "An answer counts when the DMARC result (no record, or the p= policy) and the within-10 verdict for SPF both match. SPF lookups are counted per RFC 7208 section 4.6.4: include, a, mx, ptr, exists and redirect count 1 each, nested includes count too; a macro include counts 1."
  }
 ],
 "results": [
  {
   "name": "MxToolbox SuperTool",
   "ours": false,
   "tests": [
    {
     "tested": false,
     "correct": null,
     "answered": null,
     "medianMs": null,
     "how": null,
     "notes": "web app; its lookup API needs an account key; this page already has rivals we could call, so web forms were not used",
     "inScope": null
    }
   ]
  },
  {
   "name": "EasyDMARC Domain Scanner",
   "ours": false,
   "tests": [
    {
     "tested": false,
     "correct": null,
     "answered": null,
     "medianMs": null,
     "how": null,
     "notes": "web app with no API; this page already has rivals we could call, so web forms were not used",
     "inScope": null
    }
   ]
  },
  {
   "name": "PowerDMARC MCP Server",
   "ours": false,
   "tests": [
    {
     "tested": false,
     "correct": null,
     "answered": null,
     "medianMs": null,
     "how": null,
     "notes": "needs a paid key",
     "inScope": null
    }
   ]
  },
  {
   "name": "dmarcian Domain Checker",
   "ours": false,
   "tests": [
    {
     "tested": false,
     "correct": null,
     "answered": null,
     "medianMs": null,
     "how": null,
     "notes": "web app with no API: the result is built in the browser, so a page fetch holds no answer; this page already has rivals we could call, so web forms were not used",
     "inScope": null
    }
   ]
  },
  {
   "name": "Mail-Tester",
   "ours": false,
   "tests": [
    {
     "tested": false,
     "correct": null,
     "answered": null,
     "medianMs": null,
     "how": null,
     "notes": "its main test needs a real sent message, not a domain; its free SPF and DKIM lookup at mail-tester.com/spf-dkim-check is a web form, and this page already has rivals we could call, so forms were not used",
     "inScope": null
    }
   ]
  },
  {
   "name": "IntoDNS.ai MCP",
   "ours": false,
   "tests": [
    {
     "tested": true,
     "correct": 5,
     "answered": 5,
     "medianMs": 6568,
     "inScope": null,
     "how": "remote MCP tools/call check_email_security at https://intodns.ai/api/mcp",
     "notes": "All 5 right; it flags the valid nytimes.com macro include as an invalid mechanism, and shows policy none next to exists false for openbsd.org."
    }
   ]
  },
  {
   "name": "Red Sift Investigate",
   "ours": false,
   "tests": [
    {
     "tested": false,
     "correct": null,
     "answered": null,
     "medianMs": null,
     "how": null,
     "notes": "needs a real sent message, not a domain",
     "inScope": null
    }
   ]
  },
  {
   "name": "DmarcDkim.com DMARC MCP Server",
   "ours": false,
   "tests": [
    {
     "tested": false,
     "correct": null,
     "answered": null,
     "medianMs": null,
     "how": null,
     "notes": "needs an account (sign-in for every tool)",
     "inScope": null
    }
   ]
  },
  {
   "name": "Google Admin Toolbox Check MX",
   "ours": false,
   "tests": [
    {
     "tested": false,
     "correct": null,
     "answered": null,
     "medianMs": null,
     "how": null,
     "notes": "web app with no API; this page already has rivals we could call, so web forms were not used",
     "inScope": null
    }
   ]
  },
  {
   "name": "Domain Mail Check",
   "ours": true,
   "tests": [
    {
     "tested": true,
     "correct": 5,
     "answered": 5,
     "medianMs": 8135,
     "inScope": null,
     "how": "remote MCP tools/call check_email_auth (domain only) at https://mailcheck.openkrill.app/mcp",
     "notes": "All 5 right, including the exact lookup count of 10 for github.com and mit.edu; the mit.edu call took 18 s."
    }
   ]
  }
 ]
}