Read the three checks together
SPF describes permitted senders, DKIM publishes the key used to verify message signatures, and DMARC defines alignment and policy. A published record is only one part of a working mail configuration. The report checks record presence and selected structural errors; it does not send messages, verify a delivered signature or prove inbox placement.
Use the correct selector and change policies carefully
Your email provider supplies the DKIM selector. Enter it to look up selector._domainkey.your-domain; multiple senders may use different selectors. Common-selector sampling cannot discover every key. Review legitimate senders before tightening SPF or DMARC. Start DMARC monitoring where appropriate, examine reports and test real messages before enforcing a policy. SPF include/redirect expansion and its ten-lookup limit need a separate full evaluation.