Watch the DMARC record on the sending domain

#!/usr/bin/env bash
# Compare current DMARC TXT record against a known-good baseline.
# /etc/cron.d/dmarc-watch
# */10 * * * * root /opt/dmarc.sh enterno.io '/etc/dmarc.expected'

DOMAIN=${1:?domain required}
EXPECTED_FILE=${2:?baseline file required}
EXPECTED=$(cat "$EXPECTED_FILE")
ACTUAL=$(dig +short TXT "_dmarc.$DOMAIN" | tr -d '"' | head -1)

if [ "$ACTUAL" != "$EXPECTED" ]; then
  echo "DMARC drift on $DOMAIN: was '$EXPECTED', now '$ACTUAL'" \
    | mail -s "[ALERT] DMARC change" ops@$DOMAIN
fi