What it is
MX records say which servers receive a domain's mail. SPF lists the servers allowed to send it. DKIM publishes a key that receivers use to check a message was signed by the domain and not altered. Web Check looks for it under common selector names, so "Not found" does not prove there is no key. DMARC tells receivers what to do with mail that fails both SPF and DKIM. A policy of none only monitors, so the checklist ticks DMARC once it's set to quarantine or reject. BIMI is an optional logo, and most domains skip it. MTA-STS and DANE tell other mail servers to only deliver to this domain over a verified, encrypted connection, and TLS-RPT asks them to report when they cannot.
Why it matters
Without a DMARC policy of quarantine or reject, anyone can send mail with the domain in the From line. SPF alone doesn't stop this, because it checks a hidden envelope address, not the one people see. Mistakes hurt the domain's own mail too. If there are two SPF records, or one that needs more than 10 DNS lookups, SPF fails for every message. The MX hosts and SPF includes name the mail provider and many of the vendors allowed to send, a quick way to map who an organisation works with.
How this assessment works
Skopeon Labs queries public infrastructure signals and authoritative network protocols directly from external sensor nodes. All evaluations are completely non-invasive and agentless, assessing observable configurations without sending malicious payloads or disrupting service.
Operational Scope & Limitations
This check evaluates public perimeter responses observable at the time of inquiry. Endpoints protected behind third-party reverse proxies or CDNs reflect the edge configuration of the proxy layer.