A method you can run by hand

An assessment is worth having only if somebody else can run it and get the same answer. That means a fixed sequence, public data, and a recorded output per domain — and it takes about fifteen minutes per domain by hand.

The sequence, by surface

D=example.com

# IDENTITY
dig +short TXT  $D | grep spf1
dig +short TXT  _dmarc.$D
for s in google selector1 selector2 s1 k1 fm1 dkim default; do
  dig +short TXT $s._domainkey.$D
done
curl -s https://rdap.org/domain/$D | jq -r '.status[]'
dig +short CAA  $D

# INTEGRITY
dig +short DS   $D @1.1.1.1
dig $D SOA @1.1.1.1 | grep -o 'flags:[^;]*'     # ad flag?
for ns in $(dig +short NS $D); do dig AXFR $D @$ns; done

# TRANSPORT
dig +short MX   $D
dig +short TXT  _mta-sts.$D
dig +short TXT  _smtp._tls.$D
mx=$(dig +short MX $D | sort -n | head -1 | awk '{print $2}')
dig +short TLSA _25._tcp.$mx

# PERCEPTION
dig +short TXT  default._bimi.$D
curl -s "https://crt.sh/?q=%25$D&output=json" | jq -r '.[].name_value' | sort -u

What to record per domain

Four surfaces, one row per domain, and every cell is a fact from a public query rather than a judgement. That is what makes it repeatable — the judgement happens afterwards, on a table anybody can regenerate.

At estate scale

Fifteen minutes per domain is fine for ten and not for two hundred. The sequence above scripts cleanly, and the output is a table rather than a narrative precisely so it can be generated. What does not script is the judgement: whether a domain should be sending at all, whether a selector is accounted for, whether an unexpected CT name is a takeover or a team you did not know about.