Understanding results

The JSON API and both MCP tools return the same domain-result object. Keys are JSON strings; timestamps are UTC ISO 8601. A saved read returns the same evidence and timestamp as the fresh check that produced it, with source changed to saved.

Field	Type	Meaning
`domain`	string	Normalized lowercase ASCII domain that was checked.
`checked_at`	string	UTC timestamp when the fresh check began, retained on saved reads.
`source`	`fresh` or `saved`	Whether DNS was just queried or a snapshot was read.
`saved`	boolean	On a fresh check, whether any finding had a non-unknown DNS status and the result was stored. On a saved read, always `true`.
`domain_status`	`present`, `not_found`, or `unknown`	Coarse status of the submitted domain (not an email-authentication verdict). `not_found` follows an NXDOMAIN TXT answer at the submitted name; `present` means a NOERROR TXT or MX answer at that name; otherwise `unknown`.
`findings`	array	SPF, DMARC, MX, then zero to two explicitly requested DKIM selector findings. SPF can include a nested path analysis. Always inspect `dns_status` and `spf_analysis.status` before interpreting `state`.
`recommendations`	array	Evidence-linked suggestions ordered high, medium, low; not instructions to change DNS without checking real senders.
`note`	string	Reminder that DNS configuration alone cannot validate actual messages.

Finding fields

Each finding has type (spf, dmarc, mx, or dkim), location (the DNS name actually used), state, explanation, dns_status, values (array of published TXT/MX strings), selector (string for DKIM, otherwise null), and checked_at. Depending on the check, additional fields may be present:

Field	Meaning
`issue`	Machine-readable reason for an `attention` finding, or `null` for an assessed DMARC policy without an issue. Missing SPF/MX and DNS failures may have no `issue` field even though they generate recommendations.
`all`	SPF `all` mechanism as published (for example `?all`), or `absent`. Does not prove authorization of real senders.
`spf_analysis`	For a single parseable SPF record, `status` (`complete` or `inconclusive`), `lookup_terms_upper_bound` (conservative count of lookup-causing terms through inspected references, not DNS query count or an actual sender's SPF result), and `findings` (each with `issue`, `location`, `record`, `path` of referenced domains, and `explanation`). Missing, conflicting or malformed referenced SPF policies, cycles, invalid references and a count above 10 appear here. A timeout, depth/query budget, macro or PTR makes affected paths inconclusive, not missing. No SPF record or an invalid/conflicting root record has no `spf_analysis`.
`inherited`	On assessed DMARC findings: whether the applicable record is at the organizational domain instead of the submitted subdomain.
`policy`	Assessed DMARC policy (`none`, `quarantine`, `reject`); for an inherited policy, `sp` takes precedence if present.
`tags`	Parsed DMARC tag-value object from the applicable policy.

state is one of configured (a relevant record appears published), attention (potential policy issue), not_found (the queried DNS name or relevant record was not found), or unknown (DNS could not supply a reliable answer). Configured does not mean secure or authenticated. noerror with an empty values array means the resolver answered successfully but no matching record appeared; nxdomain means the queried DNS name does not exist; unknown means a DNS error, timeout, or exhausted check budget. A failed lookup is never evidence that a policy is absent. If the submitted domain itself is NXDOMAIN, individual explanations say so and no recommendations are emitted.

For SPF, the root TXT dns_status can be noerror while a referenced path has spf_analysis.status: "inconclusive"; inspect both. The SPF state can also be unknown when a published policy has sender-dependent or unanswered references, without implying the root policy is absent. A conservative upper bound over 10 does not prove any specific message would exceed the limit.

For subdomains, DMARC is queried at _dmarc.<submitted domain>. If no record is found there, the check may use a record at _dmarc.<organizational domain>; in that case location points to the parent and inherited: true. A resolver failure at the submitted name does not assert that a parent record applies. DKIM only checks selectors you supplied; it does not discover every possible selector.

Recommendations

Each recommendation contains id, title, priority (high, medium, low), location, evidence (published values, reference path, or DNS status), action, verify, and caution. Common IDs include missing_spf, multiple_spf, malformed_spf, permissive_spf, missing_spf_reference, multiple_spf_reference, malformed_spf_reference, invalid_spf_reference, spf_cycle, spf_lookup_limit, spf_dns_unknown, missing_dmarc, multiple_dmarc, malformed_dmarc, monitoring_dmarc, missing_mx, missing_dkim, invalid_dkim, and dns_unknown. Priorities describe suggested investigation order, not a domain risk score.

Example response

Illustrative result shape from a fresh request for poshtui.com without selectors. DNS values, states, and timestamp can change; do not hard-code this example as the current state of the domain.

{
  "domain": "poshtui.com",
  "checked_at": "2026-10-01T12:02:10Z",
  "source": "fresh",
  "saved": true,
  "domain_status": "present",
  "findings": [
    {
      "type": "spf", "location": "poshtui.com", "state": "configured",
      "explanation": "Published SPF policy for the SMTP envelope sender. This check cannot verify real senders.",
      "dns_status": "noerror", "values": ["v=spf1 include:spf.messagingengine.com ?all"],
      "selector": null, "all": "?all", "checked_at": "2026-10-01T12:02:10Z",
      "spf_analysis": {"status": "complete", "lookup_terms_upper_bound": 1, "findings": []}
    },
    {
      "type": "dmarc", "location": "_dmarc.poshtui.com", "state": "attention",
      "explanation": "Published at _dmarc.poshtui.com: monitoring only. DMARC needs aligned SPF or DKIM authentication, which this check cannot test.",
      "dns_status": "noerror", "values": ["v=DMARC1; p=none;"],
      "selector": null, "issue": "monitoring_dmarc", "inherited": false,
      "policy": "none", "tags": {"p": "none"}, "checked_at": "2026-10-01T12:02:10Z"
    },
    {
      "type": "mx", "location": "poshtui.com", "state": "configured",
      "explanation": "These mail exchangers are advertised for inbound mail. Delivery is not tested.",
      "dns_status": "noerror", "values": ["10 in1-smtp.messagingengine.com", "20 in2-smtp.messagingengine.com"],
      "selector": null, "checked_at": "2026-10-01T12:02:10Z"
    }
  ],
  "recommendations": [
    {
      "id": "monitoring_dmarc", "title": "Review DMARC enforcement when ready",
      "priority": "low", "location": "_dmarc.poshtui.com",
      "evidence": ["v=DMARC1; p=none;"],
      "action": "Review legitimate senders and your own aggregate reports, fix alignment, then consider gradual enforcement.",
      "verify": "Run a new check after any DNS change; publication does not prove message authentication.",
      "caution": "Premature enforcement can disrupt legitimate mail; this service cannot see your reports."
    }
  ],
  "note": "DNS configuration is not a message-level test. SPF uses the envelope sender; DKIM uses a signing domain; DMARC checks alignment with visible From. None stops lookalike domains, display-name impersonation, or compromised accounts."
}

SPF checks the SMTP envelope sender, DKIM the signing domain, and DMARC alignment with visible From. MX advertises inbound routing. No record here proves that a particular message passed authentication, that a receiver honored a policy, or that an email reached an inbox.