Note: SPF/DKIM/DMARC checks require server-side DNS lookups. Full checks require a backend API.