DNS and email-security check of a domain: A, AAAA, MX, NS, TXT and CAA records, plus SPF and DMARC presence and policy, with plain findings (e.g. 'no DMARC: mail can be spoofed').