Understand what email DNS policy can tell you

How to use the workspace

1. Enter the email domain, not an entire email address.
2. If you have a DKIM-Signature header, copy its s= selector into the optional selector field. Leave it empty rather than guessing.
3. Submit and review the independent SPF, DMARC and DKIM status sections. Read all limitations and unresolved dependencies.

A concrete starting point

Domain: example.com
DKIM selector: selector1 (only if known)
DKIM owner: selector1._domainkey.example.com

This shows how a selector names a DNS key location; it does not assert that this example publishes that key.

Read the result carefully

Present, absent, invalid and indeterminate have different meanings. DMARC organizational-domain fallback is shown explicitly. SPF lookup count is the exploration budget consumed, not proof that a sender evaluation satisfies the RFC ten-term limit.

Common mistakes to avoid

• A present DKIM key is not a verified signature.
• SPF macros and unvisited dependencies can prevent a complete static exploration.
• A strict DMARC policy does not prove every receiving system enforces it.

Limits & privacy

DNS records only, with a 32-query budget, bounded dependency depth and a 10-second API deadline. No selector enumeration or sender authentication.