TreewalkRFC 9989

Find out why your mail is being junked.

Treewalk reads a domain's SPF, DKIM and DMARC records from public DNS, resolves what they evaluate to, and reports each check alongside the lookups it made.

Free, no account, no key. One domain per request.

What it inspects

SPF lookup count against the 10-lookup limit. RFC 7208 permits ten DNS-querying mechanisms; beyond that, evaluation returns permerror while the record still reads correctly. Treewalk follows the include: and redirect= graph and reports the count it reaches.
Subdomain policy gaps. A domain can publish p=reject at the apex and sp=none one label down, leaving every subdomain spoofable.
Inherited policy. Most subdomains have no DMARC record of their own. What actually applies is resolved by walking up the DNS tree — and the rules for that changed in May 2026.
Bulk-sender compliance. Gmail and Outlook both enforce authentication requirements above 5,000 messages/day. Outlook rejects outright: 550 5.7.515.

Implemented against RFC 9989

RFC 9989 (Proposed Standard, May 2026) obsoleted RFC 7489 and replaced Public-Suffix-List lookups with a DNS Tree Walk for finding the organizational domain, promoting the np tag to core. Treewalk implements the tree walk and prints each query in the path, so you can check the resolution against the specification rather than take the result on trust.

Not affiliated with the IETF, Google, or Microsoft. Specification references are citations, not endorsements.