A course tools page should tell a student what to do in a lesson, what evidence to produce, and whether a paid product is necessary. Organize it by learning task so it remains useful even when individual vendors change.
Each card should contain the lesson number, task, free/manual route, optional tool, expected output, and limit of the result. Label required costs before enrollment; keep optional monitoring separate from completing a one-time exercise.
dig +short TXT example.com
dig +short TXT _dmarc.example.com
# Use the message's real s= selector and d= domain:
dig +short TXT s1._domainkey.example.com
A useful answer explains that SPF authorizes the envelope sender's infrastructure, DKIM verifies a signing-domain signature, and DMARC requires a passing method aligned with the visible From domain. A student should recognize why SPF can pass for a vendor while DMARC fails, and why an aligned DKIM pass can satisfy DMARC instead.
Have students distinguish “record found” from “message verified.” A guessed DKIM selector returning no result does not prove the domain has no DKIM. A DMARC policy of p=none does not prove messages fail authentication.
Explain that ongoing monitoring addresses later changes; it is not required to understand a DNS lookup. Place any affiliate disclosure with the tool recommendation. Do not make a paid signup the hidden condition for passing a lesson that can be completed manually.
Link students to the technical checklist when they progress from a demonstration to a real campaign. Reference: DMARC alignment in RFC 7489.