<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Implementing DMARC Enforcement

## Agent Script

### Commands

| Command | Description |
|---|---|
| `node agent.js assess <domain>` | Assess SPF/DKIM/DMARC posture |
| `node agent.js check-spf <domain>` | Validate SPF record and lookup count |
| `node agent.js recommend <domain>` | Recommend next enforcement phase |
| `node agent.js analyze-reports <dir>` | Analyze DMARC aggregate reports |

### Examples

```bash
# Full domain assessment
node agent.js assess company.com

# Verify SPF stays under 10 lookups
node agent.js check-spf company.com

# Get next recommended enforcement phase
node agent.js recommend company.com

# Analyze collected DMARC reports
node agent.js analyze-reports /tmp/dmarc_reports/
```

## DNS Record Templates

| Record | Value |
|---|---|
| SPF (strict) | `v=spf1 include:_spf.google.com -all` |
| DMARC (monitor) | `v=DMARC1; p=none; rua=mailto:dmarc@co.com; fo=1` |
| DMARC (enforce) | `v=DMARC1; p=reject; rua=mailto:dmarc@co.com` |
| DKIM selector | `v=DKIM1; k=rsa; p=<base64_public_key>` |

## External Tools

| Tool | Purpose |
|---|---|
| `parsedmarc` | Parse DMARC aggregate/forensic XML reports |
| `dig TXT _dmarc.domain.com` | Query DMARC DNS record |
| `openssl genrsa` | Generate DKIM key pair |
| `dmarcian.com` | Online DMARC record inspector |
