Every result is computed live from public DNS over DoH. Nothing is cached, nothing is bought from a third-party data vendor, and no mail is sent.
Most domains that send mail are subdomains, and most subdomains publish no DMARC record of their own. Which policy actually applies is therefore a discovery problem.
RFC 7489 (2015) resolved this with two lookups and a Public Suffix List. That method was
obsoleted in May 2026 by RFC 9989,
which replaces it with a DNS Tree Walk: query _dmarc at the domain, then strip
the leftmost label and repeat, up to eight queries, stopping early on a psd tag.
RFC 9989 also promoted np — the policy for non-existent subdomains — from
experimental to core.
Treewalk implements that algorithm and prints every step it took, so you can check the work rather than trust a checkmark.
RFC 7208 §4.6.4 permits ten DNS-querying mechanisms. Exceed it and evaluation returns
permerror — SPF stops passing, but the record still reads correctly to a human.
This is the most common silent SPF failure, and it usually arrives by adding one more
include: for one more vendor.
Treewalk resolves the full include: and redirect= graph and reports
the real total.
DKIM selectors cannot be enumerated from DNS; you can only guess names. Treewalk probes the twelve most common and says so. A miss is not proof that DKIM is absent, and the report states that wherever the result appears.
Gmail and Outlook both enforce authentication above roughly 5,000 messages per day. Since
May 2025 Outlook rejects non-compliant mail outright with
550 5.7.515. Treewalk evaluates the DNS-checkable part of those requirements and
lists the rest as unverifiable instead of quietly assuming they pass.