Parse a DKIM public-key DNS TXT record ("v=DKIM1; k=rsa; p=…") into its key type, public key, hash algorithms, service types and flags. An empty `p` is reported as a revoked key. A missing `p` tag is a clean 400.

Parse a DMARC TXT record ("v=DMARC1; p=…") into its policy, alignment, sampling and reporting tags. Missing or invalid policy/alignment/pct values are clean 400s.

Evaluate an SPF record against an IPv4/IPv6 address using only its literal ip4/ip6/all mechanisms. DNS-dependent mechanisms (include, a, mx, exists, redirect) reached before a match yield an honest `indeterminate` result rather than a guess.

Parse an SPF TXT record ("v=spf1 …") into its qualified mechanisms and modifiers. Records that do not start with v=spf1 or use unknown mechanisms are clean 400s.