Everything a domain publishes about its mail is public. Fifteen minutes of queries establishes its entire posture with no access, no cooperation and nothing the domain owner can detect.
The sweep
D=example.com dig +short TXT $D | grep spf1 # SPF dig +short TXT _dmarc.$D # DMARC dig +short MX $D # inbound, and mx cost dig +short TXT _mta-sts.$D # transport policy dig +short TXT _smtp._tls.$D # TLS reporting dig +short TXT default._bimi.$D # BIMI dig +short DS $D @1.1.1.1 # DNSSEC, and DANE viability dig +short CAA $D # issuance constraints # then, per likely selector: for s in google selector1 selector2 s1 s2 k1 fm1 dkim default; do dig +short TXT $s._domainkey.$D done
What each answer tells you
| Observation | Conclusion |
|---|---|
| No DMARC record | Anyone can send as this domain and nobody is watching. The finding. |
p=none with no rua | A checkbox. No protection and no evidence, which means no path to protection either. |
p=reject with no rua | Enforcing blind, possibly for years. Nobody has seen what it rejects. |
sp absent | Subdomains inherit silently. Worth asking whether that was intended. |
SPF ending ?all or +all | Equivalent to no SPF. +all authorises the entire internet. |
| SPF over ten lookups | permerror. SPF is off for this domain entirely — run the lookup count, do not eyeball it. |
A DKIM selector answering with t=y | Signatures verify and count for nothing. |
A DKIM selector with an empty p= | Correctly revoked, which is a good sign about whoever runs this. |
| No MX and no null MX | A domain that receives nothing and does not say so. |
| BIMI present | Implies enforcement was reached and paid attention to. Cross-check the _dmarc record. |
The senders, from outside
You cannot read their aggregate reports, and the SPF record names most of their platforms anyway. Expanding every include gives you a list of who this domain has authorised, which is frequently a more accurate picture of the organisation’s tooling than its own documentation.
This is also reconnaissance
Everything above is what an attacker does first, for the same reasons and with the same tools. There is nothing to withhold — the records have to be public for receivers to use them — which is why a domain’s posture is a matter of what it publishes rather than of what it conceals.