diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 24716cf..b7bf3d6 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,10 +1,21 @@
 stages:
+  - check-dco
   - go-fmt
   - build-src
   - build-docker
   - go-test
   - docker-registry
 
+check-dco:
+  stage: check-dco
+  image: debian:buster
+  except:
+    - master
+  script:
+    - apt update
+    - apt install -y curl git jq
+    - bash ./scripts/check-dco
+
 build-src:
   stage: build-src
   image: debian:buster
diff --git a/scripts/check-dco b/scripts/check-dco
new file mode 100644
index 0000000..7c5db72
--- /dev/null
+++ b/scripts/check-dco
@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+
+emails=$(git log master..HEAD --pretty=format:'%ae' | sort | uniq)
+for email in $emails; do
+  printf "checking %s\n" "$email"
+  if ! curl -s 'https://dco.commento.io/api/has-signed' -d "email=$email" -X POST \
+         | jq '.hasSigned' \
+         | grep -q true; then
+    printf "%s has not signed the DCO: https://dco.commento.io\n" "$email"
+    exit 1
+  fi
+done