\chapter{Insights of Existing DMARC Checker and Forensics Tools}
The growing use of Domain-based Message Authentication, Reporting, and Conformance (DMARC) has resulted in a large number of new tools that purportedly aid domain owners in configuring, monitoring, and analyzing email authentication technologies. The tools vary in functionality, ranging from simple compliance checkers to sophisticated forensic applications that monitor, ingest, and interpret DMARC feedback reports. In this chapter, there is a technical evaluation of some available DMARC checker and forensics software, covering methodology, features, forensic capabilities, and inherent weaknesses.

\section{Survey of DMARC compliance checkers}
The primary goal of DMARC compliance checkers is to check for the correctness of DNS record authentication and gain insight into what occurs when a mail purported to have come from a certain domain is received by a mail server. Despite the variety that exists among these tools and their level of functionality, they are collectively meant to eliminate any resulting confusion with regard to domain abuse.


\subsection{DMARC Forensics}
\href{dmarcforensics.com}{DMARC Forensics}, developed by Professor Paolo Dal Checco, is a web-based application intended to provide evaluation of DMARC compliance and spoofing risks by linking DNS-layer security controls to real-world email abusive conditions. Unlike dashboard-style applications, DMARC Forensics is based on on-demand evaluation instead of relying on previously ingested DMARC aggregate reports.

It is a configuration-based DMARC compliance and spoofing exposure analysis tool, designed to infer domain-level spoofability from DNS-published authentication policies, rather than from observed email traffic. The tool perform a series of direct DNS queries, including: \texttt{TXT} lookup for \texttt{\_dmarc.<domain>}, SPF discovery via TXT lookup on the organizational domain and enumeration of DKIM selectors when inferable from known patterns or published records. The tool does not perform interaction or mail traffic inspection, since the analysis is entirely configuration-driven. \cite{dmarcDalChecco}

DMARC Forensics parses and evaluates:
\begin{itemize}
	\item DMARC policy tags (\texttt{p}, \texttt{sp}, \texttt{pct});
	\item Alignment modes (\texttt{adkim}, \texttt{aspf});
	\item Reporting URIs (\texttt{rua}, \texttt{ruf});
	\item Presence and strictness of SPF and DKIM policies
	\item Existence of policy contradictions (e.g., \texttt{p=none} with strict alignment)
\end{itemize}


The tool infers spoofing susceptibility demonstrateability by:
\begin{itemize}
	\item determining whether the domain publishes an enforceable DMARC policy,

	\item identifying missing or permissive authentication layers,

	\item assessing whether a forged message would be rejected, quarantined, or accepted by a DMARC-compliant receiver.

\end{itemize}

Furhtermore, the tool does not simulate email delivery nor rely on historical abuse telemetry.


\subsubsection{Methodology and findings}
DMARC Forensics tool utilizes a methodology which is designed to be aligned specifically with the requirements of a forensic or research approach rather than automation. Such an approach is defined by:
\begin{enumerate}
	\item Protocol faithful interpretation of DMARC aggregate reports, while preserving the semantic meaning of the SPF, DKIM, and alignment results as defined in RFC 7489.

	\item Correlation between DNS state and behavior, allowing the investigator to determine whether authentication failures result from misconfiguration, third-party senders, or actual abuse.

	\item Emphasis on evidentiary value to reconstruct history for domain posture and allow for conclusions regarding the maturity of law enforcement.

\end{enumerate}

From the empirical research carried out using the tool, the following facts are noted: a substantial share of those websites employs DMARC in monitoring mode (p=none) for significant periods of time, making the preventive capability of DMARC less potent while still useful for telemetry. As noted throughout the argument developed within Chapter 4 of this treatise, perhaps the greatest strength of DMARC is not merely with disposition decisions but also with providing objective, verifiable proof of abuse attempts and organizational intent.


\subsection{PowerDMARC}
PowerDMARC is a commercial SaaS product, which means it includes a complete system for monitoring and managing DMARC policies. From a technological standpoint, PowerDMARC represents a simplified approach, more focusing on usability as opposed to the complexity of the protocol stack itself, particularly in an enterprise environment.

PowerDMARC is a "full-stack" email authentication service, which means it includes not only reporting but also a managed infrastructure to overcome the inherent technical limitations of the DNS and the SPF protocol.

The service is a DMARC monitoring platform based on real-time ingestion and analysis of DMARC aggregate reports (RUA) generated by receiving mail servers.\cite{powerdmarc}

PowerDMARC relies primarily on:
\begin{itemize}
	\item SMTP-delivered XML aggregate reports sent to the rua address;
	\item Optional DNS queries to contextualize authentication results;
	\item Optional enrichment with ASN, geolocation, and reputation data.
\end{itemize}
The platform continuously parses incoming XML files and normalizes the data into an internal schema.

\subsubsection{Analysis logic}
For each reporting interval and sending source, PowerDMARC evaluates:
\begin{itemize}
	\item Source IP address
	\item SPF result and domain
	\item DKIM result and selector
	\item DMARC alignment outcome
	\item Policy disposition applied by the receiver
\end{itemize}
These parameters are then aggregated across time windows to produce trend analysis and anomaly detection.

The core logic of the tool focuses on: the identification of unatuhroized senders based on SPF/DKIM failures, the detection of configuration drift across third-party services and the support of a safe progression from \texttt{p=none} to more enforced states. From a technical standpoint, the platform acts as a large-scale parser and correlator of DMARC feedback, rather than a protocol validator.
In spite of its many features, there are some limitations to PowerDMARC, which include its dependence on receiver participation and reporting, as well as a lack of insight into attempts to spoof email blocked before DMARC evaluation.


\subsection{MxToolbox}
MXToolbox represents a lightweight, widely used diagnostic tool that focuses on real-time inspection of DNS records, including SPF, DKIM, and DMARC. Its DMARC checker validates record syntax, policy presence, and alignment indicators but does not perform longitudinal analysis or forensic correlation. As such, it is best suited for configuration verification rather than abuse investigation.

The tool performs DNS TXT lookups for SPF, DKIM, and DMARC; syntax validation of records and basic interpretation of policy directives. No historical data, reporting ingestion, or traffic observation is involved.

MxToolbox has transitioned from a suite of standalone diagnostic tools into a comprehensive "Delivery Center" designed for end-to-end deliverability management. Its technical methodology emphasizes real-time monitoring and proactive alerting based on the health of the entire email ecosystem. A component of the Delivery Center is the Adaptive Blacklist Monitoring system, which uses the telemetry extracted from DMARC RUA reports to dynamically identify every IP address sending mail on behalf of the domain.
Once an IP is detected in a report, the system automatically checks it against hundreds of DNS-based Blackhole Lists (DNSBLs). If an IP used by a legitimate service (e.g., a marketing automation platform) becomes blacklisted, MxToolbox generates an emergent alert. This creates a powerful technical synergy: DMARC provides the visibility into who is sending, and the Delivery Center provides the reputation intelligence to ensure those senders remain "clean" and capable of reaching the inbox. Finally, MxToolbox provides rigorous syntax validation engines as well, analyzing the record's structure against relevant RFCs to identify common configuration errors that can lead to deliverability failures (e.g, ensuring that the \texttt{v=DMARC1} version tag is present, the policy tag p is correctly defined, and that reporting URIs are properly formatted with the \texttt{mailto:} prefix. \cite{mxtoolboxvspowerdmarc}

\section{Forensic analysis features}
The forensic value of DMARC tools is primarily determined by how they ingest, interpret, and preserve feedback data defined by the DMARC specification.

\subsection{Aggregate vs Forensic reports}
There are two reporting mechanisms defined by the DMARC protocol:Aggregate Reports (RUA) and Forensic Reports (RUF) \cite{dmarcRFC}.
Aggregate Reports (RUA) are periodic statistical summaries of the authentication results, categorized by sending IP address, authentication result, and policy decision. Aggregate Reports are privacy-preserving and are the core of most DMARC reporting tools.

Forensic Reports (RUF) offer near-real-time feedback for individual authentication failures, although due to privacy and regulatory issues, RUF is currently deprecated and rarely implemented.
The PowerDMARC and DMARC Forensics tools mainly rely on Aggregate Reports due to current best practice and regulatory constraints.

\subsection{Export, Logging and Evidence Preservation}
From a forensic point of view, the ability to export raw data and retain historical records is essential. DMARC Forensics allows direct access to parsed aggregate data and places strong emphasis on the interpretability of individual report fields (such as source IP, SPF/DKIM result, and alignment mode). Commercial solutions usually include export capabilities in CSV and/or JSON format and often include integration with SIEM systems to retain data over time.

\subsection{Multi-domain support}
In an enterprise environment, managing multiple domains and subdomains may be necessary, including the possibility of delegating DMARC reporting addresses between domains. Advanced solutions include:
\begin{itemize}
	\item Aggregation from multiple domains
	\item Subdomain policy analysis
	\item Reporting authorization
\end{itemize}
This is a critical requirement to properly evaluate abuse within complex email infrastructures.

\section{Privacy, usability, and limitations}
The usefulness of the tools based on the DMARC analysis process is marred by the inherent limitations of the process, which are linked to the DMARC protocol. The aggregate reports do not include message content, subject, or the identifier of the message recipient. Although the decision not to include the message content, subject, or the identifier of the message recipient is in line with the privacy by design approach, it affects the ability of the system to perform forensic attribution of infrastructure.

The commercial tools, on the other hand, have been designed to offer ease of use, whereas the tools based on the DMARC analysis process, such as DMARC Forensics, offer access to raw or lightly processed data, which requires high expertise on the part of the user.

Some limitations of DMARC-based tools are present, they indeed cannot:
\begin{itemize}
	\item detect attacks from compromised legitimate sender accounts,
	\item prevent or identify content manipulation such as invoice tampering,
	\item attribute malicious intent beyond authentication failures.
\end{itemize}

The use of the DMARC forensics process should, therefore, be complemented by the use of additional security controls such as the DKIM key management, transport security, as well as business process controls, as discussed in the foregoing chapters.