SPF, DKIM and DMARC answer different questions. The DNS Inspector now combines baseline DNS records with a deeper SPF/DMARC diagnostic so these signals can be read together without creating a second catalog tool.
SPF
SPF publishes which infrastructure is authorized to send for an envelope-sender domain. The Inspector identifies the root v=spf1 record, the all qualifier and recursively discovers bounded include / redirect dependencies.
RFC 7208 limits DNS-triggering terms during SPF evaluation. The displayed graph count is therefore a useful warning signal, not a full simulation of every conditional evaluation path.
DKIM
DKIM is selector-based and cannot be exhaustively discovered from the domain alone. Absence of a known selector is never proof that DKIM is not used.
DMARC
DMARC policy interpretation follows RFC 9989. The Inspector parses the record published at _dmarc.<domain>, including current policy tags such as p, sp, np, psd and t, while flagging removed RFC 7489-era tags such as pct as legacy.
A complete receiving system can discover inherited policy through the RFC 9989 DNS Tree Walk. This tool deliberately does not claim to reproduce that complete receiver-side path.
Evidence limits
Published DNS records are configuration evidence. They do not prove that mail is successfully delivered, that every sender is legitimate, or that a message passed SPF/DKIM/DMARC in a specific transaction.