How KØNTACT works

The short version: your browser asks public DNS resolvers for your domain's email-authentication records, and a deterministic set of checks turns the answers into findings. No servers, no accounts, no magic.

1. Acquisition

DNS-over-HTTPS to Cloudflare first, Google on failure. Each request carries a 10-second timeout. If both resolvers fail — or your network blocks DNS-over-HTTPS — you can paste records manually; pasted input runs through the identical checks as DNS input.

2. Normalization

Raw records are parsed into one canonical shape. Duplicate SPF or DMARC records are preserved, not collapsed — publishing more than one is itself an error.

3. Deterministic checks

SPF: version tag, known mechanisms and modifiers, valid IP syntax, no mechanisms after a terminal all/redirect, DNS-lookup budget (10, per RFC 7208), and a bounded walk of include: chains (2 levels) to catch loops.
DMARC: required p= policy, duplicate or unknown tags, pct range, rua/ruf URI format, sp/aspf/adkim values, and external-report authorization (RFC 7489 §7.1).
DKIM: probes common selectors for published keys. Selectors are normally learned from sent-message headers, not discovery — a probe that finds nothing is informational, never a failure. You can enter a selector manually.

4. Findings

Every finding carries a state — needs attention, monitoring, protected, healthy, or note — plus an expandable evidence block showing the exact record retrieved, the resolver used, the lookup time, and the hostname queried. Auditable, never "trust the verdict."

A DMARC policy of p=none is a legitimate monitoring stage and is reported as monitoring, not an emergency. Behavior is authoritative over wording: if the implementation ever disagrees with the copy, the engine wins and the copy gets fixed.

Limitations — what this Check cannot tell you

It evaluates published posture, not delivered reality. It cannot prove inbox placement.
It cannot verify message alignment, sender reputation, or blacklist status.
It cannot confirm that every legitimate sender authenticates correctly.
DKIM discovery is limited to probed selectors; absence of a hit is not a verdict.
SPF include: chains are followed at most 2 levels deep.
The paste fallback runs the same static checks, but skips live enrichment (include-chain following and external-report authorization need working DNS — the very thing the fallback is for).
A first Check has no yesterday — it reports current state only. "Changed" requires Watch's baseline.

Contact

Found something wrong with a verdict? info@konbit.ca — wrong verdicts are the most valuable bug reports we can get.