The things that break quietly.
A domain expires. A certificate lapses. Someone edits an SPF record and mail stops being authenticated three weeks later. None of it fails loudly, and none of it shows up in a deploy. Check a domain and find out what is actually wrong.
What gets checked
Delegation
Nameservers, SOA, and whether the domain resolves at all.
DNSSEC
Signed, unsigned, or — the dangerous one — signed and failing.
SPF
Every include followed, so the ten-lookup limit is counted properly.
DMARC
Policy, reporting address, and whether p=none is quietly protecting nothing.
DKIM
A probe across the selector names the major providers use.
Mail transport
MTA-STS and TLS reporting, plus null-MX detection.