Is this domain locked down?

Data sources & privacy

The domain (and DKIM selector) you type is sent to Google Public DNS (dns.google) over HTTPS. If that fails, the same lookups go to Cloudflare DNS (cloudflare-dns.com). Those lookups are plain public DNS questions, but the resolver sees your IP address and the names you ask about.

Nothing is sent to this site, nothing is stored, and no keys are used. DNSSEC status is the "AD" (authenticated data) flag reported by the resolver; MTA-STS is checked by its DNS record only, because its policy file cannot be fetched from a browser.