RFC 7489 DMARC Policy Validator
Inspect DMARC policy enforcement (none, quarantine, reject), verify SPF/DKIM alignment, and audit external report destinations per RFC 7489.
RFC 7489 Architecture & Delivery Standards
Organizational Domain Fallback
Per RFC 7489 Section 6.6.3, if a deep subdomain like app.staging.example.com has no direct DMARC record, receivers perform exactly one fallback query at the Organizational Domain (example.com) determined by the Public Suffix List (PSL).
The Danger of p=none
Over 60% of published DMARC records use p=none. While useful for initial telemetry, p=none instructs mail receivers to deliver fraudulent emails directly to user inboxes, leaving domain reputation exposed to impersonation.
RFC 7489 § 7.1 Verification
When sending reports to external endpoints (e.g. dmarc@thirdparty.com), the receiving domain must publish an authorization record at domain._report._dmarc.thirdparty.com. Without this, receivers will drop telemetry reports.