tamingdns.com

Check the SPF record for a domain.

Look up a DKIM public key at <selector>._domainkey.<domain> and validate it.

Check the _dmarc record for a domain with DUAL discovery: the RFC 7489 §6.6.3 organisational-domain ladder (what major receivers enforce today — grade/verdict anchor to it) AND the RFC 9989 §4.10 DNS Tree Walk (8-query cap, psd=n/y stop rules, fewest-labels org selection) into analysis.discovery {legacy, tree_walk, diverges}.

Check the TLS-RPT (SMTP TLS Reporting, RFC 8460) record at _smtp._tls.<domain>.

Check MTA-STS (RFC 8461) for a domain: the _mta-sts TXT record (strict §3.1 selection — case-sensitive leading v=STSv1, exactly one record, required 1-32 alphanumeric id), the policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt fetched WITHOUT following redirects (§3.3), strict §3.2 policy validation (version/mode/max_age required, mx required unless mode none, max_age ≤ 31557600, duplicate keys first-wins), the policy-host X.509 certificate (§3.3 — an invalid cert means compliant senders fetch no policy), and live MX coverage against the mx: patterns (§4.1 — wildcards match exactly one leftmost label; coverage is all/partial/none, partial meaning strict senders skip the uncovered hosts per §5.1).

Check default._bimi.<domain>: parses the BIMI record, validates the SVG Tiny-PS logo, inspects the VMC chain (expiry, EKU, SCT, issuer-accepted, SAN match, logotype hash), and verifies the DMARC prerequisite (p=quarantine/reject at pct=100 — the RFC 7489 reading Gmail and Apple Mail evaluate today).

Check SMTP DANE / TLSA records for a domain (RFC 7672).

Validate a domain's DNSSEC chain of trust.

Inspect a domain's MX / mail-routing posture.

Analyse a pasted block of raw email headers for spoofing and phishing tells.