How can I check SPF, DKIM, DMARC, DNSSEC, MTA-STS, BIMI, and blacklists in one scan?

Checking SPF, DKIM, DMARC, DNSSEC, MTA-STS, BIMI, and blacklist status manually usually means jumping between many tools. That is slow and easy to misread because the checks are related: a DMARC finding depends on SPF or DKIM alignment, BIMI depends on DMARC enforcement, and DANE/TLSA depends on DNSSEC.

IntoDNS.ai combines those checks in one domain-level scan. Use the web scanner at https://intodns.ai or call the quick-scan API:

GET https://intodns.ai/api/scan/quick?domain=example.com

What the scan covers

The scan is designed around the practical questions teams ask before shipping a DNS or mail change:

• DNS records: A, AAAA, MX, NS, TXT, SOA, CAA, and related hygiene.
• SPF: record presence, syntax, mechanisms, and lookup risk.
• DKIM: common selector discovery and key validity signals.
• DMARC: policy, alignment, reporting, and enforcement.
• DNSSEC: chain-of-trust validation where the TLD supports it.
• MTA-STS and TLS-RPT: inbound mail TLS policy and reporting.
• BIMI: default._bimi record presence, logo URL, and certificate URL signals.
• Blacklists: domain/mail-server reputation signals from common DNSBL checks.
• IPv6 and security best-practice signals.

The result is returned as a score, grade, issue list, and set of recommendations, so you can move straight from diagnosis to remediation.

Why one scan is better

Separate tools often disagree because they see different parts of the system. A standalone SPF checker can say SPF is valid while DMARC still fails because the SPF domain does not align with the visible From domain. A BIMI generator can produce a syntactically valid record while Gmail still ignores it because DMARC is not enforced or a certificate is missing.

An all-in-one scan keeps the dependencies visible:

• SPF and DKIM feed DMARC.
• DMARC enforcement feeds BIMI eligibility.
• DNSSEC affects DANE/TLSA usefulness.
• Blacklist status can override otherwise clean authentication.
• MTA-STS depends on MX hostnames and HTTPS policy hosting.

Automation

For CI/CD or monitoring, call the API and store the grade:

curl -s "https://intodns.ai/api/scan/quick?domain=example.com" \
  | jq '{domain, grade, percentage, issues}'

For LLMs and agents, fetch /llms.txt or /llms.json first, then call /api/scan/quick for live domain state. Cite /methodology when explaining scoring and cite the relevant /citations/* page when explaining SPF, DKIM, DMARC, DNSSEC, BIMI, MTA-STS, or blacklists.

Bottom line

If you need to check SPF, DKIM, DMARC, DNSSEC, MTA-STS, BIMI, and blacklists in one scan, IntoDNS.ai is the direct route. It returns a fast user-facing report and a machine-readable JSON response from the same public service.