Mail Auth Coherence

Read an SPF record, a DMARC record and a set of DKIM selectors together, and report the combinations that defeat themselves. Every finding needs two or three records at once, which is why a single-record checker finds none of them: a reject policy with no usable selector, an enforcing policy over an SPF record ending in +all, strict alignment with subdomain senders, enforcement with no reporting address, and a subdomain policy that no sending path can satisfy.