Mail Records Audit — SPF, DKIM, DMARC and MX Together
This collects a domain's entire mail authentication configuration in one operation: the mail exchangers, the SPF record with its full expansion, the DMARC policy, and the DKIM selectors it can discover. The value over running each check separately is that the results are shown together, and mail authentication problems are usually problems of interaction.
Why run it
Because the failures live between the records. A DMARC policy set to reject is exactly right unless your SPF is missing a sending platform, in which case you have instructed the world to discard some of your own legitimate mail. DKIM alignment can fail even with valid signatures if the signing domain does not match the visible sender in the way your alignment mode requires. Neither is visible when you look at one record at a time, and both are obvious when you see the set.
Why automate it
The records are maintained by different people at different times — a platform team, a marketing team, a vendor's onboarding wizard — and each change is made without reference to the others. The dangerous combinations are created by a single innocuous edit: adding a sender without updating SPF, tightening DMARC without checking coverage. Scheduled auditing evaluates the whole configuration together after every change, which is the only way to notice that two individually correct records now contradict each other.
What it gives you
A view of mail authentication as the system it actually is, rather than four records inspected separately. That is where the expensive mistakes hide, particularly the ones that cause you to reject your own mail.