checkdmarc

What it is and what it does

checkdmarc is a Python library and command-line tool for validating email authentication infrastructure. It checks SPF records for DNS lookup efficiency and mechanism correctness, validates DMARC policies against RFC standards, verifies BIMI mark certificates against security requirements, and inspects MTA-STS and SMTP TLS reporting policies. It also reports on MX record configuration, nameserver setup, and SOA records.

The package provides three interfaces: a Python API for programmatic use, a CLI that outputs results in JSON or CSV format, and support for batch checking of multiple domains. It includes DNSSEC validation and checks for common misconfigurations like ineffective DMARC `sp` values or deprecated RFC 9989 tags. Most users will reach for it to audit domain email security posture or integrate email authentication checks into security workflows.

Use it for:

• Audit a domain's SPF record for DNS lookup efficiency and validate mechanism syntax before deployment.
• Check DMARC policy compliance and detect configurations that may be ineffective due to `sp` or deprecated tags.
• Validate BIMI mark certificates against Minimum Security Requirements before issuance or renewal.
• Batch-check multiple domains' email authentication records and export results as JSON or CSV for reporting.
• Integrate email authentication validation into a security scanning or compliance tool via the Python API.
• Verify MTA-STS and SMTP TLS reporting policies are correctly configured on a domain.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Validates SPF, DMARC, BIMI, MTA-STS, and related email authentication DNS records, with API, CLI, and JSON/CSV output modes.

Yes. The package is actively maintained, has no known vulnerabilities, installs with low friction, and solves a specific and important problem in email security. It is suitable for security teams, domain administrators, and developers building email infrastructure tools. The Apache-2.0 license poses no restriction.

Install

checkdmarc on PyPI

pip install checkdmarc

uv add checkdmarc

poetry add checkdmarc

Installing checkdmarc

Before you install

Low friction: pure Python wheel with 10 runtime dependencies including well-established libraries like cryptography, dnspython, and requests. Actively maintained with a release 17 days old and last commit on 2026-07-28.

License in practice

Apache-2.0 permissive license allows commercial and private use with minimal restrictions; suitable for most deployment scenarios.

Quickstart

pip install checkdmarc

from checkdmarc import check_domain
result = check_domain('example.com')
print(result['dmarc']['record'])

Requires Python 3.10 or later; DNS queries depend on network connectivity and nameserver availability.

Verify before relying

• Whether the package handles internationalized domain names (IDNs) correctly in all validation modes.
• Performance characteristics when checking large batches of domains or deeply nested SPF includes.
• Whether DNSSEC validation failures are treated as hard errors or warnings in programmatic use.

Package facts

Evidence: checkdmarc-5.17.4-py3-none-any.whl

Keywords: BIMI, DMARC, DNS, MTA-STS, SPF

Tags

More Security packages