What this tool does
Runs SPF, DKIM, and DMARC checks together and reports what's configured for each — the three mechanisms are related, so evaluating them as a set catches gaps that checking just one in isolation would miss.
How the three mechanisms work together
SPF publishes which servers are authorized to send mail for your domain. DKIM cryptographically signs outgoing mail so receivers can verify it wasn't altered in transit. DMARC ties the two together, telling receiving servers what to do when a message fails SPF or DKIM alignment, and where to send reports about it. A domain with only one or two of the three configured has a real gap a spoofer can exploit.
About the DKIM check specifically
Unlike SPF and DMARC, which live at fixed, predictable DNS locations, a DKIM record's location depends on the selector your mail provider chose — there's no way to discover it directly from DNS alone. This check tests a handful of common selector names real-world providers default to; a "not found" result means DKIM wasn't found under those common names specifically, not that it's definitely unconfigured under a custom one.
When you'd use this
Before switching email providers, after setting up a new sending domain, or when troubleshooting why legitimate mail is intermittently landing in recipients' spam folders.