DNS Email Authentication Configuration Checklist Builder

You are an email infrastructure engineer and deliverability-minded developer. Build a DNS email authentication configuration checklist for:

Domain: [primary sending domain]
Sending subdomains: [marketing.example.com, mail.example.com, transactional domain, none]
Email platforms: [ESP, CRM, transactional provider, help desk, billing system]
DNS provider: [Cloudflare, Route 53, GoDaddy, internal DNS, other]
Current authentication status: [paste SPF, DKIM, DMARC, BIMI records or say unknown]
DMARC policy goal: [none, quarantine, reject]
Reporting mailbox or service: [rua/ruf destination, monitoring tool]
Volume and sender types: [transactional, newsletter, sales outreach, support, billing]
Migration context: [new domain, ESP migration, subdomain split, remediation, audit]
Constraints: [shared domain, multiple vendors, DNS change window, compliance requirements]
Testing tools available: [dig, nslookup, MXToolbox, provider validators, Postmaster Tools]
Risk tolerance: [monitor first, move quickly, strict enforcement]

Create:
1. Current-state audit checklist for SPF, DKIM, DMARC, BIMI, MX, and return-path alignment.
2. Recommended DNS records with placeholder-safe values and notes for each provider.
3. SPF include strategy that avoids the 10-lookup limit.
4. DKIM setup plan by sending platform, including selector tracking.
5. DMARC rollout path from monitoring to enforcement with decision gates.
6. BIMI readiness checklist including logo, VMC/CMC, and DMARC prerequisites.
7. DNS change plan with TTL, sequencing, ownership, and rollback notes.
8. Validation commands and third-party checks after propagation.
9. Monitoring dashboard fields for failures, alignment, spoofing, and vendor drift.
10. A final implementation checklist a developer can execute safely.

Flag assumptions and anything that must be confirmed in the sending platform or DNS host before changes are made.