Which DMARC record actually governs your mail subdomain?

Mailbox providers check the mail subdomain's own DMARC record first and only fall back to the root domain's if none exists -- getting this resolution order wrong misreads your own compliance status.

This is one of the things Transactional Email Deliverability Core already handles. Send transactional email that actually lands, and stop emailing people who bounce or complain.

Buy for $793 of 3 clean-room builds passed · full refund if it fails on your machine

Is this you?

A domain sending mail from a dedicated subdomain (mail.yourdomain.com) has two DMARC records that could apply: one at _dmarc.mail.yourdomain.com and one at _dmarc.yourdomain.com. A DNS checker that only looks at the root record, or only at the subdomain record, can report the wrong effective policy -- either falsely flagging a properly staged subdomain rollout as unprotected, or missing that the root record is silently governing mail it was never meant to.

Why this one is easy to get wrong

DMARC's actual resolution order -- check the exact subdomain first, walk up to the organizational domain only if nothing exists there -- is specified in the DMARC RFC, not something obvious from just knowing DMARC records exist. A checker that queries only one of the two levels will look like it's working, right up until the specific case (a record at one level but not the other) that the simplified version doesn't handle.

What you get instead

The pack's checkRecords() function implements the same resolution order receiving mail servers actually use: the effective DMARC record is _dmarc.mail.yourdomain.com if present, otherwise it falls back to _dmarc.yourdomain.com. This is exactly what lets a buyer with other root-domain senders escalate DMARC enforcement only on the mail subdomain, and have the DNS checker correctly report that as the record actually in force.

Source: ARCHITECTURE.md 'DNS + DMARC staging' — checkable in the pack you receive

How you actually use this

You don’t install a library or wire up an SDK. Your own coding agent builds the code in your project, and you keep it — no runtime dependency on us.

Step 1
Download and unzip
You get a folder: the docs that tell an agent what to build, a starting skeleton, and the test suite that decides when it's done.
Step 2
Open it in Claude Code or Cursor
Point your coding agent at the folder. Nothing to install, no account with us, no API key.
Step 3
Paste one prompt
The pack contains the exact prompt. Paste it as your first message and leave it alone — it works through the build itself, choosing a cheaper or stronger model per task.
Step 4
Run ./verify.sh
One command. It prints a pass or fail for every check. Green means the build is done — the same script we ran to produce the receipt on this page.

Typical build: about 13 minutes of your agent working, mostly unattended. Then you integrate the working module into your app the way you would any code you’d written yourself.

Why you can believe this

3 of 3 runs passed

We ran this pack from an empty folder 3 times and published exactly what happened — every check, the model, the token cost, the wall time. Not a testimonial, and not our opinion: the same verify.sh you run yourself. Read the full receipt →

Buy for $79 14-day refund if verify.sh fails →