DMARC Inspector

Fetches the DMARC record at _dmarc.<domain>, parses every tag, and flags anything that would stop it from working as intended — a missing report address, subdomains held to a weaker policy than the domain itself, or a report destination that hasn't authorized receiving your reports.

What this checks

Whether a DMARC record exists at all, and whether it's valid (correct v=DMARC1 tag, no duplicate records).
The policy (p) and subdomain policy (sp) — and flags it if subdomains are held to a weaker standard than the domain itself.
Whether aggregate reports (rua) are configured, since without them there's no visibility into who's sending as this domain.
If reports go to a different domain, whether that domain has published the authorization record DMARCbis requires — the most common reason reports silently stop arriving.
Legacy tags (pct, ri, rf) that DMARCbis removed — harmless to leave, flagged as informational only.