What is checked?

With online diagnostics enabled, WM Guard searches the public DNS TXT records of the site domain for an SPF record and a DMARC policy at _dmarc.<domain>.

Which details are evaluated?

For SPF, WM Guard can identify the all behavior. For DMARC, it reads the policy none, quarantine, or reject when present.

DKIM

DKIM is not evaluated generically because the selector in use would need to be known.

Privacy and caching

DNS queries necessarily reveal the queried domain name to the configured DNS resolver. Results are cached for twelve hours.