dns health
where your name points, who may send as you
Your domain name does two jobs. It points visitors at the website, and it tells the rest of the internet who may send email in your name. The second is where the damage happens, and it stays invisible until somebody uses it.
About this check
·Why this is about your name rather than your website
Nothing here touches the site itself. These are records held at your DNS host, and they decide whether a stranger can send mail that arrives looking exactly like yours. A domain with no SPF and no DMARC is one anybody can impersonate to your own customers, and the customer has no way to tell the difference.
·DKIM has to be guessed, and the page says so
SPF and DMARC sit at fixed addresses, so either they are published or they are not. DKIM sits at <selector>._domainkey, and DNS offers nobody a way to list the selectors a domain uses. This check probes the eight names mail providers actually use. A result of "not found" means DKIM is at none of those — it may still be at a custom selector, and the page tells you that rather than calling it missing.
·The two nobody looks at until the day they matter
Nameservers and CAA. Two nameservers on separate networks keep the domain answering when one has an outage; with one, a single failure takes the name down. A CAA record names which certificate authorities are allowed to issue for you, and where there is none, any authority in the world may.