What this DNS security checker tests
Your DNS records do more than point a name at a server. A handful of them decide whether someone can send mail in your name, request a certificate for your domain, or quietly redirect your visitors. This checker reads five of those records live and tells you which ones protect you and which ones leave a gap.
Three of the records secure email. SPF lists the servers allowed to send mail for your domain, so a receiver can reject mail from anywhere else. DKIM adds a cryptographic signature to each message that proves it really came from you and was not changed on the way. DMARC ties the two together and tells inbox providers what to do when a message fails, for example quarantine it or reject it outright. With all three in place, an attacker who tries to spoof your domain finds their phishing mail bounced or sent to spam.
The other two records protect the domain itself. CAA names the certificate authorities that are permitted to issue certificates for you, which stops a different CA from being tricked into issuing a certificate an attacker could use to impersonate your site. DNSSEC signs your DNS records so a resolver can detect a forged answer, the kind of tampering behind cache poisoning that sends visitors to a server an attacker controls.
How to add the records you are missing
Each record is a line you publish at your DNS host. Add a TXT record for SPF that lists your sending services, turn on DKIM signing in your mail provider and publish the public key it gives you, then add a DMARC TXT record starting at a policy of none to monitor before you move to quarantine or reject. Add a CAA record naming the CA you actually use, and enable DNSSEC from your registrar or DNS provider with one setting in most panels. For the full walkthrough, format examples, and the order to roll these out safely, read the DNS security guide.