Treewalk audits a domain's SPF, DKIM and DMARC from public DNS and tells you,
specifically, what is broken — including the failures that look fine to the eye.
Free, no account, no key. One domain per request.
What it catches that a green checkmark does not
SPF permerrors from the 10-lookup limit. Add one provider too many and SPF fails
outright. The record still looks correct. Treewalk resolves every include:
chain and counts them.
Subdomain policy gaps. A domain can publish p=reject at the apex and
sp=none one label down, leaving every subdomain spoofable.
Inherited policy. Most subdomains have no DMARC record of their own. What actually
applies is resolved by walking up the DNS tree — and the rules for that changed in May 2026.
Bulk-sender compliance. Gmail and Outlook both enforce authentication requirements
above 5,000 messages/day. Outlook rejects outright: 550 5.7.515.
Correct as of RFC 9989
RFC 9989 (Proposed Standard, May 2026)
obsoleted RFC 7489 and replaced Public-Suffix-List lookups with a DNS Tree Walk for finding
the organizational domain, promoting the np tag to core. Tools written against the old
spec can resolve subdomain policy by the wrong algorithm. Treewalk implements the tree walk and
shows you every step it took.
Not affiliated with the IETF, Google, or Microsoft. Specification references are citations, not endorsements.