Every record a domain
publishes about itself
A, AAAA, NS, MX, CAA, TXT and SOA with their values — plus whether DNSSEC, SPF, DKIM and DMARC are actually in place, not just whether something was found. Free, no signup, 5 checks a day.
5 free checks a day. No signup, no key.
Six records, six different ways to be exposed
DNSSEC
Signs the zone so a resolver can prove the answer it received is the answer the zone published. Unsigned is the default across most of the internet, and it is what lets a poisoned cache go unnoticed.
CAA
Names the certificate authorities allowed to issue for the domain. Without one, any public CA may issue a certificate for your name and the first you hear of it is the certificate transparency log.
SPF
Lists the servers allowed to send mail as the domain. A receiving server checks it before deciding whether the envelope sender is plausible.
DKIM
Signs outgoing mail with a key published in DNS. The selector is chosen by the sender and listed nowhere a checker can enumerate, so not finding one does not prove the domain signs nothing.
DMARC
Tells receivers what to do when SPF and DKIM disagree with the From address, and where to send the reports. Without it, a failed check is advisory and nothing acts on it.