Enter a domain and see its MX, SPF, DMARC and DKIM records, what each one actually says, and what's missing. These are the settings that decide whether your mail reaches the inbox.
Try stripe.com, github.com or cloudflare.com.
MX says which servers accept mail for the domain. Without it, the domain can't receive email at all.
SPF lists which servers are allowed to send mail as the domain. Receivers check the sending server against this list. It's one TXT record, and there can only be one.
DKIM publishes a public key so receivers can verify a cryptographic signature on each message, proving it wasn't altered. Keys live at selector._domainkey.yourdomain.com, and the selector is chosen by whoever sends your mail — this checks the common ones, so a miss doesn't always mean DKIM is absent.
DMARC ties SPF and DKIM to the visible From address and tells receivers what to do when checks fail. Without it, the other two do far less work than you'd think.
All four matter more than any wording in your email. A domain with no SPF and no DMARC sending bulk mail will land in spam regardless of how the message is written. Google and Yahoo now require authentication for bulk senders outright.
Lookups go to Cloudflare's public DNS-over-HTTPS resolver directly from your browser. Nothing is stored, and no account is needed. DNS is public information — you're asking the same question any mail server would.
A TXT record listing which servers may send mail as your domain. Receivers check the sending server against it. There can only be one SPF record per domain — a second one makes both fail.
DMARC ties SPF and DKIM results to the visible From address and tells receivers what to do when checks fail. Without it someone can pass SPF on their own domain while displaying yours. If you send any volume of mail, you need it.
It means DMARC is in monitoring mode: failures are reported but nothing is blocked. It's the right starting point while you're setting up, but it offers no protection against spoofing on its own.
The DKIM selector name is chosen by whoever sends your mail and can be anything. This checks the common ones, so a miss doesn't prove DKIM is absent. Look at a message you've sent — the s= value in its DKIM-Signature header is your selector.
SPF allows a maximum of ten DNS-lookup mechanisms. Beyond that it fails entirely, which usually surprises people who have added one service at a time over the years.