Tool
SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI, with the things generic checkers miss: the RFC 7208 ten-lookup limit, whether an MTA-STS policy actually exists behind the DNS record that promises it, and whether the policy covers the MX hosts that are live right now.
Beyond whether a record exists: the qualifier it ends on, whether more than one record is published (which is a permerror, not a merge), and the DNS lookup count. RFC 7208 caps that count at ten. Over the cap the evaluation is a permerror and most receivers treat a permerror as no SPF at all. The record still resolves. It still looks correct in a lookup. It has simply stopped working, usually because somebody added one more vendor to a record that was already at nine. In the 100,000-domain survey this had happened to 3.4% of every SPF record published.
Policy strength, subdomain policy, pct, and whether an aggregate reporting address is set. The common failures are a policy left at p=none where it blocks nothing, enforcement with no rua so there is no way to see what is being enforced, and sp=none under an enforcing p, which leaves every subdomain spoofable while the main domain looks protected.
Selectors are arbitrary strings chosen by the sender. Probing a list of common ones and finding nothing proves nothing, so a miss is reported as inconclusive rather than as absent. Where a key is found, the approximate key length is reported, because keys under 1024 bits are rejected outright by several receivers.
The DNS record is a promise that a policy exists at
https://mta-sts.<domain>/.well-known/mta-sts.txt. If that URL 404s
the entire mechanism is inert while appearing configured, and a DNS-only checker will
call it enabled. This one fetches the policy, parses it as the
key: value format RFC 8461 actually specifies, and compares the MX hosts
it lists against the MX records that are live. Under enforce, mail to an uncovered MX
host is refused.
A composite verdict against the Gmail, Yahoo and Microsoft requirements for senders over 5,000 messages a day. Two of those requirements, one-click List-Unsubscribe and a complaint rate under 0.3%, are not visible from DNS, so the report says so rather than guessing.
In your browser. The DNS lookups go from your machine to a public DNS-over-HTTPS resolver, not through this site, so the domain you type is never sent here and there is nothing to log. The one exception is the MTA-STS policy file: a page cannot fetch a URL on another origin, so that single request is proxied, and the endpoint takes a domain rather than a URL so it cannot be used to fetch anything else.
It is the same logic as dmarcsight, which is the command-line version and the source of truth. The two are tested against each other on every build, so this page cannot tell you something the tool would not.