SPF lookup budget
SPF mechanisms such as include, a, mx, exists and redirect can cause DNS lookups. Nested includes count toward the limit. The tree identifies repeated branches and loops; macros and sender-dependent evaluation limit what a static inspection can conclude.
DKIM selectors and public keys
A selector identifies a key at selector._domainkey.example.com. DNS does not provide a complete selector directory. Enter the selector from a real message for a reliable lookup. Finding a key does not verify the signature of that message.
DMARC policy and alignment
DMARC connects the visible From domain with authenticated SPF or DKIM identifiers. p=none monitors, while quarantine and reject request stronger receiver handling. Deploy enforcement only after checking legitimate senders and aggregate reports.
MX and optional mail policies
MX priorities rank mail servers. A single 0 . record is Null MX and means no inbound email is accepted. Optional BIMI, MTA-STS and TLS-RPT DNS records add policy information, but their existence alone does not prove that logos, HTTPS policies or TLS delivery work.
Interpret the score carefully
The score summarizes DNS configuration checks and excludes unavailable sections. It is not a deliverability score, an inbox-placement prediction or a complete security audit. Organizational-domain fallback uses a bounded suffix list, so uncommon public suffixes need manual verification.