Direct answer
A DNS checker reports what is published at a name. A received-message result reports how a receiver evaluated a particular path, identity, signature, and message body at a particular time. The distinction matters because similar-looking labels can describe different identities, sources, and observation windows. The intended outcome is straightforward: Know when a record lookup is sufficient and when the original received message is required.
Before acting, write down the exact identifier, message, provider, and UTC observation time involved. That small evidence boundary prevents a general domain assumption from replacing the result of the actual check. It also gives the next reviewer enough context to repeat the work without seeing unrelated recipient data or credentials.
Prepare the evidence
Use information you are authorized to inspect. Preserve exact protocol values such as domains, selectors, IP addresses, tags, and response classes, but redact local parts, API keys, cookies, mailbox credentials, and unrelated content before sharing. Name the source of each observation and keep unavailable sources outside any passing or not-listed total.
The preparation should answer four questions: what was tested, which system made the observation, when it was observed, and what the observation cannot prove. If any answer is missing, record the gap instead of filling it with a guess.
Work through the method
- Use DNS checks to find records, syntax issues, selectors, and declared policy.
- Use message headers to confirm the evaluated SPF identity and actual DKIM signatures.
- Use DMARC results to connect passing mechanisms to the visible From domain.
- Retest after DNS propagation with a newly sent message.
Keep each step reversible. When the method calls for a change, record the previous value, owner, intended effect, and rollback condition. Send or query again only after the change is in effect, and use a fresh message or logical run when the evidence belongs to a new event.
Worked example
A DKIM key can be present in DNS while a message fails because its body changed after signing. The key lookup and signature result are both accurate but describe different layers.
Write the example as an identity-and-evidence table when several domains or providers are involved. A reader should be able to point to the field supporting each conclusion. If the evidence supports several explanations, list those explanations and the next observation that would distinguish them.
Interpret the result
Separate a protocol fact from a product status and from an operational recommendation. A record can be present while a message fails; a server can accept a message without placing it in the inbox; and a source can be unavailable without returning a clean result. Preserve complete, partial, unknown, unavailable, and failed outcomes as different states.
Use the result to choose one next check. Repeating an unrelated checker or changing several DNS records at the same time usually reduces the value of the evidence. Where a plan allowance applies, retries with the same logical submission should follow the documented idempotency behavior rather than creating duplicate work.
Limits and failure cases
Cached DNS, split views, forwarding, intermediary rewriting, and receiver implementation choices can make a lookup and old message appear inconsistent. Results also age: DNS, keys, provider policies, list entries, message paths, and account configuration can change after the observation. Do not turn this bounded evidence into a guarantee of future delivery, mailbox ownership, universal reputation, or logo display.
An empty, timed-out, or unsupported observation should remain unknown or unavailable. It should never be rewritten as pass, valid, or not listed merely to make a report look complete.
Next useful action
Open the checker for policy inspection, then validate the change with a fresh message test. Retain the report identifier and the smallest redacted evidence needed for comparison. If the result changes a published instruction, create a reviewed content revision and flag dependent translations instead of silently rewriting them.
Primary references for review
- RFC 7208: Sender Policy Framework
- RFC 6376: DomainKeys Identified Mail
- RFC 8601: Authentication-Results
These links support the technical review of this draft. Their presence is not a claim that an accountable reviewer has approved every sentence, provider behavior, or localized version.