Comprehensive DMARC record checks

api/openapi.yaml

@@ -914,6 +914,27 @@ components:
           enum: [none, quarantine, reject, unknown]
           description: DMARC policy
           example: "quarantine"
+        subdomain_policy:
+          type: string
+          enum: [none, quarantine, reject, unknown]
+          description: DMARC subdomain policy (sp tag) - policy for subdomains if different from main policy
+          example: "quarantine"
+        percentage:
+          type: integer
+          minimum: 0
+          maximum: 100
+          description: Percentage of messages subjected to filtering (pct tag, default 100)
+          example: 100
+        spf_alignment:
+          type: string
+          enum: [relaxed, strict]
+          description: SPF alignment mode (aspf tag)
+          example: "relaxed"
+        dkim_alignment:
+          type: string
+          enum: [relaxed, strict]
+          description: DKIM alignment mode (adkim tag)
+          example: "relaxed"
         valid:
           type: boolean
           description: Whether the DMARC record is valid

pkg/analyzer/dns.go

@@ -420,20 +420,38 @@ func (d *DNSAnalyzer) checkDMARCRecord(domain string) *api.DMARCRecord {
 	// Extract policy
 	policy := d.extractDMARCPolicy(dmarcRecord)
 
+	// Extract subdomain policy
+	subdomainPolicy := d.extractDMARCSubdomainPolicy(dmarcRecord)
+
+	// Extract percentage
+	percentage := d.extractDMARCPercentage(dmarcRecord)
+
+	// Extract alignment modes
+	spfAlignment := d.extractDMARCSPFAlignment(dmarcRecord)
+	dkimAlignment := d.extractDMARCDKIMAlignment(dmarcRecord)
+
 	// Basic validation
 	if !d.validateDMARC(dmarcRecord) {
 		return &api.DMARCRecord{
-			Record: &dmarcRecord,
-			Policy: api.PtrTo(api.DMARCRecordPolicy(policy)),
-			Valid:  false,
-			Error:  api.PtrTo("DMARC record appears malformed"),
+			Record:          &dmarcRecord,
+			Policy:          api.PtrTo(api.DMARCRecordPolicy(policy)),
+			SubdomainPolicy: subdomainPolicy,
+			Percentage:      percentage,
+			SpfAlignment:    spfAlignment,
+			DkimAlignment:   dkimAlignment,
+			Valid:           false,
+			Error:           api.PtrTo("DMARC record appears malformed"),
 		}
 	}
 
 	return &api.DMARCRecord{
-		Record: &dmarcRecord,
-		Policy: api.PtrTo(api.DMARCRecordPolicy(policy)),
-		Valid:  true,
+		Record:          &dmarcRecord,
+		Policy:          api.PtrTo(api.DMARCRecordPolicy(policy)),
+		SubdomainPolicy: subdomainPolicy,
+		Percentage:      percentage,
+		SpfAlignment:    spfAlignment,
+		DkimAlignment:   dkimAlignment,
+		Valid:           true,
 	}
 }
 
@@ -448,6 +466,71 @@ func (d *DNSAnalyzer) extractDMARCPolicy(record string) string {
 	return "unknown"
 }
 
+// extractDMARCSPFAlignment extracts SPF alignment mode from a DMARC record
+// Returns "relaxed" (default) or "strict"
+func (d *DNSAnalyzer) extractDMARCSPFAlignment(record string) *api.DMARCRecordSpfAlignment {
+	// Look for aspf=s (strict) or aspf=r (relaxed)
+	re := regexp.MustCompile(`aspf=(r|s)`)
+	matches := re.FindStringSubmatch(record)
+	if len(matches) > 1 {
+		if matches[1] == "s" {
+			return api.PtrTo(api.DMARCRecordSpfAlignmentStrict)
+		}
+		return api.PtrTo(api.DMARCRecordSpfAlignmentRelaxed)
+	}
+	// Default is relaxed if not specified
+	return api.PtrTo(api.DMARCRecordSpfAlignmentRelaxed)
+}
+
+// extractDMARCDKIMAlignment extracts DKIM alignment mode from a DMARC record
+// Returns "relaxed" (default) or "strict"
+func (d *DNSAnalyzer) extractDMARCDKIMAlignment(record string) *api.DMARCRecordDkimAlignment {
+	// Look for adkim=s (strict) or adkim=r (relaxed)
+	re := regexp.MustCompile(`adkim=(r|s)`)
+	matches := re.FindStringSubmatch(record)
+	if len(matches) > 1 {
+		if matches[1] == "s" {
+			return api.PtrTo(api.DMARCRecordDkimAlignmentStrict)
+		}
+		return api.PtrTo(api.DMARCRecordDkimAlignmentRelaxed)
+	}
+	// Default is relaxed if not specified
+	return api.PtrTo(api.DMARCRecordDkimAlignmentRelaxed)
+}
+
+// extractDMARCSubdomainPolicy extracts subdomain policy from a DMARC record
+// Returns the sp tag value or nil if not specified (defaults to main policy)
+func (d *DNSAnalyzer) extractDMARCSubdomainPolicy(record string) *api.DMARCRecordSubdomainPolicy {
+	// Look for sp=none, sp=quarantine, or sp=reject
+	re := regexp.MustCompile(`sp=(none|quarantine|reject)`)
+	matches := re.FindStringSubmatch(record)
+	if len(matches) > 1 {
+		return api.PtrTo(api.DMARCRecordSubdomainPolicy(matches[1]))
+	}
+	// If sp is not specified, it defaults to the main policy (p tag)
+	// Return nil to indicate it's using the default
+	return nil
+}
+
+// extractDMARCPercentage extracts the percentage from a DMARC record
+// Returns the pct tag value or nil if not specified (defaults to 100)
+func (d *DNSAnalyzer) extractDMARCPercentage(record string) *int {
+	// Look for pct=<number>
+	re := regexp.MustCompile(`pct=(\d+)`)
+	matches := re.FindStringSubmatch(record)
+	if len(matches) > 1 {
+		// Convert string to int
+		var pct int
+		fmt.Sscanf(matches[1], "%d", &pct)
+		// Validate range (0-100)
+		if pct >= 0 && pct <= 100 {
+			return &pct
+		}
+	}
+	// Default is 100 if not specified
+	return nil
+}
+
 // validateDMARC performs basic DMARC record validation
 func (d *DNSAnalyzer) validateDMARC(record string) bool {
 	// Must start with v=DMARC1
@@ -657,7 +740,7 @@ func (d *DNSAnalyzer) CalculateDNSScore(results *api.DNSResults) (int, string) {
 	// DMARC ties SPF and DKIM together and provides policy
 	if results.DmarcRecord != nil {
 		if results.DmarcRecord.Valid {
-			score += 15
+			score += 10
 			// Bonus points for stricter policies
 			if results.DmarcRecord.Policy != nil {
 				switch *results.DmarcRecord.Policy {
@@ -671,6 +754,43 @@ func (d *DNSAnalyzer) CalculateDNSScore(results *api.DNSResults) (int, string) {
 					score -= 5
 				}
 			}
+			// Bonus points for strict alignment modes (2 points each)
+			if results.DmarcRecord.SpfAlignment != nil && *results.DmarcRecord.SpfAlignment == api.DMARCRecordSpfAlignmentStrict {
+				score += 1
+			}
+			if results.DmarcRecord.DkimAlignment != nil && *results.DmarcRecord.DkimAlignment == api.DMARCRecordDkimAlignmentStrict {
+				score += 1
+			}
+			// Subdomain policy scoring (sp tag)
+			// +3 for stricter or equal subdomain policy, -3 for weaker
+			if results.DmarcRecord.SubdomainPolicy != nil {
+				mainPolicy := string(*results.DmarcRecord.Policy)
+				subPolicy := string(*results.DmarcRecord.SubdomainPolicy)
+
+				// Policy strength: none < quarantine < reject
+				policyStrength := map[string]int{"none": 0, "quarantine": 1, "reject": 2}
+
+				mainStrength := policyStrength[mainPolicy]
+				subStrength := policyStrength[subPolicy]
+
+				if subStrength >= mainStrength {
+					// Subdomain policy is equal or stricter
+					score += 3
+				} else {
+					// Subdomain policy is weaker
+					score -= 3
+				}
+			} else {
+				// No sp tag means subdomains inherit main policy (good default)
+				score += 3
+			}
+			// Percentage scoring (pct tag)
+			// Apply the percentage on the current score
+			if results.DmarcRecord.Percentage != nil {
+				pct := *results.DmarcRecord.Percentage
+
+				score = score * pct / 100
+			}
 		} else if results.DmarcRecord.Record != nil {
 			// Partial credit if DMARC record exists but has issues
 			score += 5

pkg/analyzer/dns_test.go

@@ -397,3 +397,241 @@ func TestValidateBIMI(t *testing.T) {
 		})
 	}
 }
+
+func TestExtractDMARCSPFAlignment(t *testing.T) {
+	tests := []struct {
+		name              string
+		record            string
+		expectedAlignment string
+	}{
+		{
+			name:              "SPF alignment - strict",
+			record:            "v=DMARC1; p=quarantine; aspf=s",
+			expectedAlignment: "strict",
+		},
+		{
+			name:              "SPF alignment - relaxed (explicit)",
+			record:            "v=DMARC1; p=quarantine; aspf=r",
+			expectedAlignment: "relaxed",
+		},
+		{
+			name:              "SPF alignment - relaxed (default, not specified)",
+			record:            "v=DMARC1; p=quarantine",
+			expectedAlignment: "relaxed",
+		},
+		{
+			name:              "Both alignments specified - check SPF strict",
+			record:            "v=DMARC1; p=quarantine; aspf=s; adkim=r",
+			expectedAlignment: "strict",
+		},
+		{
+			name:              "Both alignments specified - check SPF relaxed",
+			record:            "v=DMARC1; p=quarantine; aspf=r; adkim=s",
+			expectedAlignment: "relaxed",
+		},
+		{
+			name:              "Complex record with SPF strict",
+			record:            "v=DMARC1; p=reject; rua=mailto:dmarc@example.com; aspf=s; adkim=s; pct=100",
+			expectedAlignment: "strict",
+		},
+	}
+
+	analyzer := NewDNSAnalyzer(5 * time.Second)
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := analyzer.extractDMARCSPFAlignment(tt.record)
+			if result == nil {
+				t.Fatalf("extractDMARCSPFAlignment(%q) returned nil, expected non-nil", tt.record)
+			}
+			if string(*result) != tt.expectedAlignment {
+				t.Errorf("extractDMARCSPFAlignment(%q) = %q, want %q", tt.record, string(*result), tt.expectedAlignment)
+			}
+		})
+	}
+}
+
+func TestExtractDMARCDKIMAlignment(t *testing.T) {
+	tests := []struct {
+		name              string
+		record            string
+		expectedAlignment string
+	}{
+		{
+			name:              "DKIM alignment - strict",
+			record:            "v=DMARC1; p=reject; adkim=s",
+			expectedAlignment: "strict",
+		},
+		{
+			name:              "DKIM alignment - relaxed (explicit)",
+			record:            "v=DMARC1; p=reject; adkim=r",
+			expectedAlignment: "relaxed",
+		},
+		{
+			name:              "DKIM alignment - relaxed (default, not specified)",
+			record:            "v=DMARC1; p=none",
+			expectedAlignment: "relaxed",
+		},
+		{
+			name:              "Both alignments specified - check DKIM strict",
+			record:            "v=DMARC1; p=quarantine; aspf=r; adkim=s",
+			expectedAlignment: "strict",
+		},
+		{
+			name:              "Both alignments specified - check DKIM relaxed",
+			record:            "v=DMARC1; p=quarantine; aspf=s; adkim=r",
+			expectedAlignment: "relaxed",
+		},
+		{
+			name:              "Complex record with DKIM strict",
+			record:            "v=DMARC1; p=reject; rua=mailto:dmarc@example.com; aspf=r; adkim=s; pct=100",
+			expectedAlignment: "strict",
+		},
+	}
+
+	analyzer := NewDNSAnalyzer(5 * time.Second)
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := analyzer.extractDMARCDKIMAlignment(tt.record)
+			if result == nil {
+				t.Fatalf("extractDMARCDKIMAlignment(%q) returned nil, expected non-nil", tt.record)
+			}
+			if string(*result) != tt.expectedAlignment {
+				t.Errorf("extractDMARCDKIMAlignment(%q) = %q, want %q", tt.record, string(*result), tt.expectedAlignment)
+			}
+		})
+	}
+}
+
+func TestExtractDMARCSubdomainPolicy(t *testing.T) {
+	tests := []struct {
+		name           string
+		record         string
+		expectedPolicy *string
+	}{
+		{
+			name:           "Subdomain policy - none",
+			record:         "v=DMARC1; p=quarantine; sp=none",
+			expectedPolicy: stringPtr("none"),
+		},
+		{
+			name:           "Subdomain policy - quarantine",
+			record:         "v=DMARC1; p=reject; sp=quarantine",
+			expectedPolicy: stringPtr("quarantine"),
+		},
+		{
+			name:           "Subdomain policy - reject",
+			record:         "v=DMARC1; p=quarantine; sp=reject",
+			expectedPolicy: stringPtr("reject"),
+		},
+		{
+			name:           "No subdomain policy specified (defaults to main policy)",
+			record:         "v=DMARC1; p=quarantine",
+			expectedPolicy: nil,
+		},
+		{
+			name:           "Complex record with subdomain policy",
+			record:         "v=DMARC1; p=reject; sp=quarantine; rua=mailto:dmarc@example.com; pct=100",
+			expectedPolicy: stringPtr("quarantine"),
+		},
+	}
+
+	analyzer := NewDNSAnalyzer(5 * time.Second)
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := analyzer.extractDMARCSubdomainPolicy(tt.record)
+			if tt.expectedPolicy == nil {
+				if result != nil {
+					t.Errorf("extractDMARCSubdomainPolicy(%q) = %v, want nil", tt.record, result)
+				}
+			} else {
+				if result == nil {
+					t.Fatalf("extractDMARCSubdomainPolicy(%q) returned nil, expected %q", tt.record, *tt.expectedPolicy)
+				}
+				if string(*result) != *tt.expectedPolicy {
+					t.Errorf("extractDMARCSubdomainPolicy(%q) = %q, want %q", tt.record, string(*result), *tt.expectedPolicy)
+				}
+			}
+		})
+	}
+}
+
+func TestExtractDMARCPercentage(t *testing.T) {
+	tests := []struct {
+		name               string
+		record             string
+		expectedPercentage *int
+	}{
+		{
+			name:               "Percentage - 100",
+			record:             "v=DMARC1; p=quarantine; pct=100",
+			expectedPercentage: intPtr(100),
+		},
+		{
+			name:               "Percentage - 50",
+			record:             "v=DMARC1; p=quarantine; pct=50",
+			expectedPercentage: intPtr(50),
+		},
+		{
+			name:               "Percentage - 25",
+			record:             "v=DMARC1; p=reject; pct=25",
+			expectedPercentage: intPtr(25),
+		},
+		{
+			name:               "Percentage - 0",
+			record:             "v=DMARC1; p=none; pct=0",
+			expectedPercentage: intPtr(0),
+		},
+		{
+			name:               "No percentage specified (defaults to 100)",
+			record:             "v=DMARC1; p=quarantine",
+			expectedPercentage: nil,
+		},
+		{
+			name:               "Complex record with percentage",
+			record:             "v=DMARC1; p=reject; sp=quarantine; rua=mailto:dmarc@example.com; pct=75",
+			expectedPercentage: intPtr(75),
+		},
+		{
+			name:               "Invalid percentage > 100 (ignored)",
+			record:             "v=DMARC1; p=quarantine; pct=150",
+			expectedPercentage: nil,
+		},
+		{
+			name:               "Invalid percentage < 0 (ignored)",
+			record:             "v=DMARC1; p=quarantine; pct=-10",
+			expectedPercentage: nil,
+		},
+	}
+
+	analyzer := NewDNSAnalyzer(5 * time.Second)
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := analyzer.extractDMARCPercentage(tt.record)
+			if tt.expectedPercentage == nil {
+				if result != nil {
+					t.Errorf("extractDMARCPercentage(%q) = %v, want nil", tt.record, *result)
+				}
+			} else {
+				if result == nil {
+					t.Fatalf("extractDMARCPercentage(%q) returned nil, expected %d", tt.record, *tt.expectedPercentage)
+				}
+				if *result != *tt.expectedPercentage {
+					t.Errorf("extractDMARCPercentage(%q) = %d, want %d", tt.record, *result, *tt.expectedPercentage)
+				}
+			}
+		})
+	}
+}
+
+// Helper functions for test pointers
+func stringPtr(s string) *string {
+	return &s
+}
+
+func intPtr(i int) *int {
+	return &i
+}

web/src/lib/components/DmarcRecordDisplay.svelte

@@ -0,0 +1,211 @@
+<script lang="ts">
+    import type { DMARCRecord } from "$lib/api/types.gen";
+
+    interface Props {
+        dmarcRecord?: DMARCRecord;
+    }
+
+    let { dmarcRecord }: Props = $props();
+
+    // Helper function to determine policy strength
+    const policyStrength = (policy: string | undefined): number => {
+        const strength: Record<string, number> = { none: 0, quarantine: 1, reject: 2 };
+        return strength[policy || 'none'] || 0;
+    };
+</script>
+
+{#if dmarcRecord}
+    <div class="card mb-4">
+        <div class="card-header d-flex justify-content-between align-items-center">
+            <h5 class="text-muted mb-0">
+                <i
+                    class="bi"
+                    class:bi-check-circle-fill={dmarcRecord.valid && dmarcRecord.policy != "none"}
+                    class:text-success={dmarcRecord.valid && dmarcRecord.policy != "none"}
+                    class:bi-arrow-up-circle-fill={dmarcRecord.valid && dmarcRecord.policy == "none"}
+                    class:text-warning={dmarcRecord.valid && dmarcRecord.policy == "none"}
+                    class:bi-x-circle-fill={!dmarcRecord.valid}
+                    class:text-danger={!dmarcRecord.valid}
+                ></i>
+                Domain-based Message Authentication
+            </h5>
+            <span class="badge bg-secondary">DMARC</span>
+        </div>
+        <div class="card-body">
+            <p class="card-text small text-muted mb-2">DMARC builds on SPF and DKIM by telling receiving servers what to do with emails that fail authentication checks. It also enables reporting so you can monitor your email security.</p>
+
+            <!-- Status -->
+            <div class="mb-2">
+                <strong>Status:</strong>
+                {#if dmarcRecord.valid}
+                    <span class="badge bg-success">Valid</span>
+                {:else}
+                    <span class="badge bg-danger">Invalid</span>
+                {/if}
+            </div>
+
+            <!-- Policy -->
+            {#if dmarcRecord.policy}
+                <div class="mb-3">
+                    <strong>Policy:</strong>
+                    <span class="badge {dmarcRecord.policy === 'reject' ? 'bg-success' : dmarcRecord.policy === 'quarantine' ? 'bg-warning' : 'bg-secondary'}">
+                        {dmarcRecord.policy}
+                    </span>
+                    {#if dmarcRecord.policy === 'reject'}
+                        <div class="alert alert-success mt-2 mb-0 small">
+                            <i class="bi bi-shield-check me-1"></i>
+                            <strong>Maximum protection</strong> — emails failing DMARC checks are rejected. This provides the strongest defense against spoofing and phishing.
+                        </div>
+                    {:else if dmarcRecord.policy === 'quarantine'}
+                        <div class="alert alert-info mt-2 mb-0 small">
+                            <i class="bi bi-check-circle me-1"></i>
+                            <strong>Good protection</strong> — emails failing DMARC checks are quarantined (sent to spam). This is a safe middle ground.<br>
+                            <i class="bi bi-arrow-up-circle me-1"></i>
+                            Once you've validated your configuration and ensured all legitimate mail passes, consider upgrading to <code>p=reject</code> for maximum protection.
+                        </div>
+                    {:else if dmarcRecord.policy === 'none'}
+                        <div class="alert alert-warning mt-2 mb-0 small">
+                            <i class="bi bi-exclamation-triangle me-1"></i>
+                            <strong>Monitoring only</strong> — emails failing DMARC are delivered normally. This is only recommended during initial setup.<br>
+                            <i class="bi bi-arrow-up-circle me-1"></i>
+                            After monitoring reports, upgrade to <code>p=quarantine</code> or <code>p=reject</code> to actively protect your domain.
+                        </div>
+                    {:else}
+                        <div class="alert alert-danger mt-2 mb-0 small">
+                            <i class="bi bi-x-circle me-1"></i>
+                            <strong>Unknown policy</strong> — the policy value is not recognized. Valid options are: none, quarantine, or reject.
+                        </div>
+                    {/if}
+                </div>
+            {/if}
+
+            <!-- Subdomain Policy -->
+            {#if dmarcRecord.subdomain_policy}
+                {@const mainStrength = policyStrength(dmarcRecord.policy)}
+                {@const subStrength = policyStrength(dmarcRecord.subdomain_policy)}
+                <div class="mb-3">
+                    <strong>Subdomain Policy:</strong>
+                    <span class="badge {dmarcRecord.subdomain_policy === 'reject' ? 'bg-success' : dmarcRecord.subdomain_policy === 'quarantine' ? 'bg-warning' : 'bg-secondary'}">
+                        {dmarcRecord.subdomain_policy}
+                    </span>
+                    {#if subStrength >= mainStrength}
+                        <div class="alert alert-success mt-2 mb-0 small">
+                            <i class="bi bi-check-circle me-1"></i>
+                            <strong>Good configuration</strong> — subdomain policy is equal to or stricter than main policy.
+                        </div>
+                    {:else}
+                        <div class="alert alert-warning mt-2 mb-0 small">
+                            <i class="bi bi-exclamation-triangle me-1"></i>
+                            <strong>Weaker subdomain protection</strong> — consider setting <code>sp={dmarcRecord.policy}</code> to match your main policy for consistent protection.
+                        </div>
+                    {/if}
+                </div>
+            {:else if dmarcRecord.policy}
+                <div class="mb-3">
+                    <strong>Subdomain Policy:</strong>
+                    <span class="badge bg-info">Inherits main policy</span>
+                    <div class="alert alert-success mt-2 mb-0 small">
+                        <i class="bi bi-check-circle me-1"></i>
+                        <strong>Good default</strong> — subdomains inherit the main policy (<code>{dmarcRecord.policy}</code>) which provides consistent protection.
+                    </div>
+                </div>
+            {/if}
+
+            <!-- Percentage -->
+            {#if dmarcRecord.percentage !== undefined}
+                <div class="mb-3">
+                    <strong>Enforcement Percentage:</strong>
+                    <span class="badge {dmarcRecord.percentage === 100 ? 'bg-success' : dmarcRecord.percentage >= 50 ? 'bg-warning' : 'bg-danger'}">
+                        {dmarcRecord.percentage}%
+                    </span>
+                    {#if dmarcRecord.percentage === 100}
+                        <div class="alert alert-success mt-2 mb-0 small">
+                            <i class="bi bi-check-circle me-1"></i>
+                            <strong>Full enforcement</strong> — all messages are subject to DMARC policy. This provides maximum protection.
+                        </div>
+                    {:else if dmarcRecord.percentage >= 50}
+                        <div class="alert alert-warning mt-2 mb-0 small">
+                            <i class="bi bi-exclamation-triangle me-1"></i>
+                            <strong>Partial enforcement</strong> — only {dmarcRecord.percentage}% of messages are subject to DMARC policy. Consider increasing to <code>pct=100</code> once you've validated your configuration.
+                        </div>
+                    {:else}
+                        <div class="alert alert-danger mt-2 mb-0 small">
+                            <i class="bi bi-x-circle me-1"></i>
+                            <strong>Low enforcement</strong> — only {dmarcRecord.percentage}% of messages are protected. Gradually increase to <code>pct=100</code> for full protection.
+                        </div>
+                    {/if}
+                </div>
+            {:else if dmarcRecord.policy}
+                <div class="mb-3">
+                    <strong>Enforcement Percentage:</strong>
+                    <span class="badge bg-success">100% (default)</span>
+                    <div class="alert alert-success mt-2 mb-0 small">
+                        <i class="bi bi-check-circle me-1"></i>
+                        <strong>Full enforcement</strong> — all messages are subject to DMARC policy by default.
+                    </div>
+                </div>
+            {/if}
+
+            <!-- SPF Alignment -->
+            {#if dmarcRecord.spf_alignment}
+                <div class="mb-3">
+                    <strong>SPF Alignment:</strong>
+                    <span class="badge {dmarcRecord.spf_alignment === 'strict' ? 'bg-success' : 'bg-info'}">
+                        {dmarcRecord.spf_alignment}
+                    </span>
+                    {#if dmarcRecord.spf_alignment === 'relaxed'}
+                        <div class="alert alert-info mt-2 mb-0 small">
+                            <i class="bi bi-check-circle me-1"></i>
+                            <strong>Recommended for most senders</strong> — ensures legitimate subdomain mail passes.<br>
+                            <i class="bi bi-exclamation-triangle me-1"></i>
+                            For maximum brand protection, consider strict alignment (<code>aspf=s</code>) once your sending domains are standardized.
+                        </div>
+                    {:else}
+                        <div class="alert alert-success mt-2 mb-0 small">
+                            <i class="bi bi-shield-check me-1"></i>
+                            <strong>Maximum brand protection</strong> — only exact domain matches are accepted. Ensure all legitimate mail comes from the exact From domain.
+                        </div>
+                    {/if}
+                </div>
+            {/if}
+
+            <!-- DKIM Alignment -->
+            {#if dmarcRecord.dkim_alignment}
+                <div class="mb-3">
+                    <strong>DKIM Alignment:</strong>
+                    <span class="badge {dmarcRecord.dkim_alignment === 'strict' ? 'bg-success' : 'bg-info'}">
+                        {dmarcRecord.dkim_alignment}
+                    </span>
+                    {#if dmarcRecord.dkim_alignment === 'relaxed'}
+                        <div class="alert alert-info mt-2 mb-0 small">
+                            <i class="bi bi-check-circle me-1"></i>
+                            <strong>Recommended for most senders</strong> — ensures legitimate subdomain mail passes.<br>
+                            <i class="bi bi-exclamation-triangle me-1"></i>
+                            For maximum brand protection, consider strict alignment (<code>adkim=s</code>) once your sending domains are standardized.
+                        </div>
+                    {:else}
+                        <div class="alert alert-success mt-2 mb-0 small">
+                            <i class="bi bi-shield-check me-1"></i>
+                            <strong>Maximum brand protection</strong> — only exact domain matches are accepted. Ensure all DKIM signatures use the exact From domain.
+                        </div>
+                    {/if}
+                </div>
+            {/if}
+
+            <!-- Record -->
+            {#if dmarcRecord.record}
+                <div class="mb-2">
+                    <strong>Record:</strong><br>
+                    <code class="d-block mt-1 text-break">{dmarcRecord.record}</code>
+                </div>
+            {/if}
+
+            <!-- Error -->
+            {#if dmarcRecord.error}
+                <div class="text-danger">
+                    <strong>Error:</strong> {dmarcRecord.error}
+                </div>
+            {/if}
+        </div>
+    </div>
+{/if}

web/src/lib/components/DnsRecordsCard.svelte

@@ -3,6 +3,7 @@
     import { getScoreColorClass } from "$lib/score";
     import GradeDisplay from "./GradeDisplay.svelte";
     import MxRecordsDisplay from "./MxRecordsDisplay.svelte";
+    import DmarcRecordDisplay from "./DmarcRecordDisplay.svelte";
 
     interface Props {
         dnsResults?: DNSResults;
@@ -205,53 +206,7 @@
             {/if}
 
             <!-- DMARC Record -->
-            {#if dnsResults.dmarc_record}
-                <div class="card mb-4">
-                    <div class="card-header d-flex justify-content-between align-items-center">
-                        <h5 class="text-muted mb-0">
-                            <i
-                                class="bi"
-                                class:bi-check-circle-fill={dnsResults.dmarc_record.valid}
-                                class:text-success={dnsResults.dmarc_record.valid}
-                                class:bi-x-circle-fill={!dnsResults.dmarc_record.valid}
-                                class:text-danger={!dnsResults.dmarc_record.valid}
-                            ></i>
-                            Domain-based Message Authentication
-                        </h5>
-                        <span class="badge bg-secondary">DMARC</span>
-                    </div>
-                    <div class="card-body">
-                        <p class="card-text small text-muted mb-2">DMARC builds on SPF and DKIM by telling receiving servers what to do with emails that fail authentication checks. It also enables reporting so you can monitor your email security.</p>
-                        <div class="mb-2">
-                            <strong>Status:</strong>
-                            {#if dnsResults.dmarc_record.valid}
-                                <span class="badge bg-success">Valid</span>
-                            {:else}
-                                <span class="badge bg-danger">Invalid</span>
-                            {/if}
-                        </div>
-                        {#if dnsResults.dmarc_record.policy}
-                            <div class="mb-2">
-                                <strong>Policy:</strong>
-                                <span class="badge {dnsResults.dmarc_record.policy === 'reject' ? 'bg-success' : dnsResults.dmarc_record.policy === 'quarantine' ? 'bg-warning' : 'bg-secondary'}">
-                                    {dnsResults.dmarc_record.policy}
-                                </span>
-                            </div>
-                        {/if}
-                        {#if dnsResults.dmarc_record.record}
-                            <div class="mb-2">
-                                <strong>Record:</strong><br>
-                                <code class="d-block mt-1 text-break">{dnsResults.dmarc_record.record}</code>
-                            </div>
-                        {/if}
-                        {#if dnsResults.dmarc_record.error}
-                            <div class="text-danger">
-                                <strong>Error:</strong> {dnsResults.dmarc_record.error}
-                            </div>
-                        {/if}
-                    </div>
-                </div>
-            {/if}
+            <DmarcRecordDisplay dmarcRecord={dnsResults.dmarc_record} />
 
             <!-- BIMI Record -->
             {#if dnsResults.bimi_record}