What this tool does
SPF, DKIM, and DMARC together form the foundation of email authentication — the mechanism that stops anyone from sending email that impersonates your domain. This tool checks all three in a single request: whether your SPF record exists and what it contains, whether a DMARC record exists and what policy it sets, and whether a DKIM record exists under any of a list of common selectors.
SPF: who's allowed to send on your behalf
An SPF (Sender Policy Framework) record lists the servers authorized to send email for your domain — typically your email provider plus any third-party service you use for sending (a marketing tool, a CRM, and so on). Without SPF, a receiving server has no way to tell a legitimate email from you apart from a spoofed one sent from any other server. A domain that uses several sending services but only lists one of them in its SPF record will often see mail from the others land in spam.
DKIM: the signature that proves integrity
DKIM (DomainKeys Identified Mail) cryptographically signs each outgoing email with a private key, and publishes the matching public key in DNS under a name called a "selector." The recipient checks the signature against that public key to confirm the email wasn't altered in transit and really did come from a server holding the private key. Unlike SPF, there's no public way to discover which selector a domain uses without already knowing it — that's why this tool checks a list of common selectors instead of guaranteeing a definitive answer.
DMARC: the policy that closes the loop
DMARC builds on SPF and DKIM to tell recipients what to do with an email that fails either check: take no special action (p=none, often used while testing), send it to quarantine/spam (p=quarantine), or reject it outright (p=reject). DMARC also adds a reporting mechanism (rua=) that alerts the domain owner to detected spoofing attempts — often the first time a company learns its domain is being actively used for phishing.
A caution about comparing domains
A well-configured domain doesn't necessarily have all three mechanisms active at once, or all set to the same strictness. A brand-new domain that isn't sending any email yet can legitimately have neither SPF nor DMARC; a large domain with dozens of third-party sending services may have a long, complex SPF record that looks "worse" than a short one without that being an actual problem. Treat these results as a starting point for an audit, not as an absolute score.