Most domains fail this without knowing it — no DMARC record, or a policy that only monitors and never blocks. Gmail, Yahoo and Microsoft all now enforce sender rules that check this. Enter a domain and get the real answer in seconds.
We only run public DNS lookups and public HTTPS fetches (SPF/DKIM/DMARC/MTA-STS/TLS-RPT/BIMI/DNSSEC/MX). Nothing is installed, nothing is emailed, and we don’t need any access to your mail server.