The domain report

What it does

The report takes one check run and lays it out as a document: a cover carrying the score and a report id, a contents page, an executive summary in plain English, every check in one table, the actions to take, then each check in full with the exact DNS records the verdict was drawn from.

The screen version and the PDF are the SAME template. There is no separate print layout to fall out of step, so what you read on screen is what the person you forward it to reads on paper.

Why it matters

A result on a screen is read by one person once. A document is what gets forwarded to the IT provider who will actually make the change, kept for the next audit, and used to check months later whether anything was done.

It is also written for two readers at once, which is the hard part. The summary and the actions are for whoever decides; the evidence and the methodology are marked Technical so an engineer can find them and everyone else can skip them without losing the thread.

How to read it

1. Start at the executive summary. If you read nothing else, read the exposure paragraph and the single most important thing to do.
2. Look at configured is not the same as effective. A record can be published, look strict, and be ignored by every receiver - that table is where you find out.
3. Actions to take is ordered so you can work top to bottom safely. Anything that tells a receiving mail server to start refusing your messages is deliberately last. A few earlier steps do touch how mail reaches you or who may send as you, and each of those carries a caveat saying what to confirm before you publish.
4. Each action names who performs it - you, whoever runs your DNS, or your email provider. Most changes are not made by the same people.
5. Use the glossary for any abbreviation. It only lists terms the report actually used.
6. Use the methodology section to reproduce any finding yourself. The lookups are printed as commands you can run.

What it does not do

It reports what your domain publishes, not what your mail is doing. Lookalike domains, display-name spoofing and compromised mailboxes are all outside what these checks can see, and the report says so in its own words rather than leaving you to assume otherwise.

It states no verdict the check engine did not produce. Where a check could not reach a conclusion, the report says it was not determined instead of guessing in either direction.

It is a photograph of public DNS at one moment. The generation time and the report id are on the cover for exactly that reason - a report from last quarter describes last quarter.

What is not built yet