Put a tool recommendation after the reader understands the diagnostic question. The tutorial should still teach the method if the reader never opens your referral link.
For a DMARC lesson, first explain that the policy lives at _dmarc under the domain. Then show the query:
dig +short TXT _dmarc.example.com
Explain that p=none requests no DMARC-specific enforcement, while quarantine and reject request stronger handling of failures. The record alone does not establish whether a specific message passes: that requires an aligned SPF or DKIM pass.
After the manual explanation, offer the Beacon free check as another way to inspect public authentication signals. Tell readers which result to compare with the command output. If results differ, check the exact queried domain, timing, and cached DNS before assuming one tool is broken.
Ask the reader to explain why a published record is different from a passing message. If they can answer that, the tutorial has taught something beyond clicking a checker.
Use the course tools-page exercise for graded instruction and RFC 7489 for protocol detail.