Email fails quietly. A missing SPF record, a DMARC policy that only watches, or one forgotten sending service pushes a company's mail to spam or lets someone else send as it, and nobody is told. This check reads everything your domain publishes about mail and scores it as one picture.
It looks at your mail servers, SPF (including every nested include, which is where the ten-lookup limit is usually broken), DKIM keys at the selectors providers commonly use, DMARC, MTA-STS and TLS reporting, and whether the addresses your mail servers use are on public blocklists. It only reads public DNS and makes a single web request for your MTA-STS policy.
One SPF record ending in -all (or ~all with an enforced DMARC), DKIM signing from every sender, DMARC at quarantine or reject with reports going to a mailbox somebody reads, and MTA-STS published. Domains that send no mail should say so with a null MX and v=spf1 -all.
DKIM has no directory. A key lives at a selector name only the sender chooses, so we test the selectors that Google Workspace, Microsoft 365, Zoho, Mailchimp, SendGrid and others use. If yours is different, the check cannot see it. Send yourself an email and read the s= value in its DKIM-Signature header.
Each list is tested before it is believed: it must list its own test address and must not list an address that cannot be listed. A list that fails that test is shown as not checked rather than as clear. Spamhaus does not answer shared resolvers, so it is not queried here; check it at check.spamhaus.org.
No. It reads DNS and fetches one policy file. No message is sent to or from your domain.