SPF, DKIM, DMARC, MTA-STS and DNSSEC, read the way Gmail reads them. Every problem comes back with the record that fixes it.
No signup. Nothing stored.
| SPF lookup limit | SPF fails outright past 10 DNS lookups. Most checkers show the record and never count them. |
| p=none | Publishing DMARC to satisfy Google and Yahoo does not stop anyone spoofing you. |
| Weak DKIM keys | 1024-bit and smaller keys still sit in plenty of zones. |
| Open subdomains | An enforced policy with sp=none leaves every subdomain spoofable. |
| Silent DMARC | No rua address means no reports, so you never learn who sends as you. |