CONTROL PLANE ARCHITECTURE · RFC 7489 & RFC 7208

The Safe-to-Reject Architecture.

DMARC enforcement fails when organizations make a blind leap from p=none to p=reject without knowing what will break. DmarcLock is the deterministic control plane that audits third-party senders, eliminates SPF lookup limits, and governs DNS mutations.

LAYER 01·Ingestion & Classification

RFC 7489 RUA Telemetry Engine

High-throughput XML aggregate parser that processes daily DMARC reports from Google, Microsoft, Yahoo, and Cloudflare. Classifies outbound streams into verified business vendors and surfaces rogue IP relays.

Ingests gzip-compressed XML aggregates via mailto: and HTTP webhook endpoints

Deterministic vendor fingerprinting for 50+ enterprise SaaS senders

Real-time IP reputation, ASN mapping, and forwarder anomaly detection

rua_ingestion_stream.log

READ-ONLY

[04:12:08 UTC] INGEST: report_id=google.com!acme.com!1744243200
  source_ip: 209.85.220.41 (Google Workspace) -> spf=pass dkim=pass -> ALIGNED
[04:12:11 UTC] INGEST: report_id=yahoodns.net!acme.com!1744243200
  source_ip: 54.240.27.12 (AWS SES) -> spf=pass dkim=fail (s=ses key expired)
  ALERT: DKIM alignment blocker detected on production sending cluster

LAYER 02·Safety Gates & Verification

Safe-to-Reject Readiness Engine

The core invariant engine that prevents billing blackouts and dropped emails. Calculates a deterministic readiness verdict by running 14 boolean checks across DNS authority and live telemetry.

Hard-blocks p=reject mutations when active blockers > 0

Validates DKIM 2048-bit key alignment across third-party providers

Enforces explicit sp=reject to prevent spoofed subdomain phishing

enforcement_readiness.json

READ-ONLY

{
  "domain": "acme-corp.com",
  "verdict": "BLOCKED",
  "blockers": [
    {
      "id": "spf-lookup-overflow",
      "severity": "CRITICAL",
      "message": "SPF record requires 12 DNS lookups (RFC 7208 limit is 10)"
    },
    {
      "id": "vendor-dkim-misaligned",
      "vendor": "Stripe",
      "message": "DKIM selector stripe._domainkey not verified in DNS"
    }
  ]
}

LAYER 03·Protocol Optimization

Recursive SPF 10-Lookup Flattener

Solves the RFC 7208 lookup wall. Recursively traverses nested include:, a:, and mx: mechanisms, validates CIDR ranges, and generates flattened zero-lookup TXT records.

Recursive DNS resolver caching prevents lookup exhaustion

Automatic IP deduplication and contiguous CIDR subnet aggregation

Partitions records automatically if 255-character or 512-byte UDP limits are exceeded

spf_flatten_diff.dns

READ-ONLY

; BEFORE (12 Lookups - RFC 7208 PermError):
v=spf1 include:_spf.google.com include:sendgrid.net include:mailgun.org include:servers.mcsv.net ~all

; AFTER DMARCLOCK RECURSIVE FLATTENING (1 Lookup - RFC Safe):
v=spf1 ip4:35.190.247.0/24 ip4:167.89.0.0/17 ip4:198.2.128.0/18 ip4:209.85.128.0/17 -all

LAYER 04·Governance & Automation

Governed DNS Control Plane & Rollback Ledger

Direct API mutation engine for Cloudflare, GoDaddy, DigitalOcean, and Vercel. Every DNS change takes a pre-flight snapshot, enters an HMAC-SHA256 audit ledger, and enables 1-click rollback.

API-driven record sync without storing long-term master DNS credentials

Pre-flight DNS state capture stored before any record is overwritten

1-click instantaneous rollback restoring previous DNS state in < 5 seconds

dns_mutation_ledger.log

READ-ONLY

[DNS_SYNC] ACTION=CREATE RECORD_TYPE=TXT NAME=_dmarc.acme-corp.com
  PROVIDER=Cloudflare ZONE_ID=023e105f...
  PRE_FLIGHT_SNAPSHOT=snap_7894a8f9 (SHA256: d8a9f4...)
  PAYLOAD: "v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc@ingest.dmarclock.com;"
  RESULT: 200 OK (Sync time: 412ms)
  AUDIT_HASH: hmac_sha256(user_id=usr_92, timestamp=1744243200, action=SYNC)

SECURITY GUARANTEES

Built for zero-trust DNS operations.

We never take custody of your nameservers or proxy your email traffic.

Zero NS Delegation

You maintain 100% control of your authoritative DNS. DmarcLock communicates via authenticated API endpoints only.

1-Click Safe Rollback

Every DNS record update captures a pre-flight state snapshot. Revert policy or SPF modifications with a single click.

Fail-Closed Safety Gate

Mutations that set p=reject are hard-blocked at the service layer if active blockers are detected.

Ready to verify your sending infrastructure?

Run a non-destructive inspection of your live SPF, DKIM, and DMARC posture in 5 seconds.

Inspect Your Domain Read API Docs

Loading…

[04:12:08 UTC] INGEST: report_id=google.com!acme.com!1744243200 source_ip: 209.85.220.41 (Google Workspace) -> spf=pass dkim=pass -> ALIGNED [04:12:11 UTC] INGEST: report_id=yahoodns.net!acme.com!1744243200 source_ip: 54.240.27.12 (AWS SES) -> spf=pass dkim=fail (s=ses key expired) ALERT: DKIM alignment blocker detected on production sending cluster

{ "domain": "acme-corp.com", "verdict": "BLOCKED", "blockers": [ { "id": "spf-lookup-overflow", "severity": "CRITICAL", "message": "SPF record requires 12 DNS lookups (RFC 7208 limit is 10)" }, { "id": "vendor-dkim-misaligned", "vendor": "Stripe", "message": "DKIM selector stripe._domainkey not verified in DNS" } ] }

; BEFORE (12 Lookups - RFC 7208 PermError): v=spf1 include:_spf.google.com include:sendgrid.net include:mailgun.org include:servers.mcsv.net ~all ; AFTER DMARCLOCK RECURSIVE FLATTENING (1 Lookup - RFC Safe): v=spf1 ip4:35.190.247.0/24 ip4:167.89.0.0/17 ip4:198.2.128.0/18 ip4:209.85.128.0/17 -all

[DNS_SYNC] ACTION=CREATE RECORD_TYPE=TXT NAME=_dmarc.acme-corp.com PROVIDER=Cloudflare ZONE_ID=023e105f... PRE_FLIGHT_SNAPSHOT=snap_7894a8f9 (SHA256: d8a9f4...) PAYLOAD: "v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc@ingest.dmarclock.com;" RESULT: 200 OK (Sync time: 412ms) AUDIT_HASH: hmac_sha256(user_id=usr_92, timestamp=1744243200, action=SYNC)