Domain health

Check whether your mail will actually arrive.

Eight checks on any domain: sender authentication, spoofing policy, mail routing, encrypted delivery, certificate, registration expiry and DNS signing.

Free. No test message is sent.·No tracking.

Querying — via 1.1.1.1
Reading DNS records
SPF
DKIM
DMARC
Mail servers
Registration
DNSSEC
MTA-STS
TLS certificate
Following every include in the SPF chain - this can take a few seconds
What an answer looks like
SPFOK
DKIM2048
DMARCnone
MXOK
Registration321d
DNSSECoff
MTA-STS—
TLS42d
Incomplete. SPF is strict but DMARC blocks nothing.
7 / 10
The difference

Reading the line isn't enough. We follow it.

An SPF fault is almost never visible in the record you are looking at. It sits one step down, inside someone else's list.

What a quick look shows
  • SPF record present
  • DKIM found
  • DMARC record published
  • Certificate valid
What we show
  • 7 of 10 lookups used - 4 of them inside other people's lists
  • Selector selector1, key 2048 bits
  • p=none - the record exists but stops nothing
  • 42 days left, issued by Let's Encrypt
The silent failure

SPF stops working at ten lookups

Every provider you add to your SPF record costs DNS lookups, and everything inside their list counts too. Cross ten and the record stops applying - entirely. Your mail starts bouncing, and nothing in your settings looks wrong.

Counting the line you can see isn't enough. We follow every include all the way down and show the real number.

v=spf1 a mx include:spf.protection.outlook.com include:_spf.google.com include:servers.mcsv.net include:eu.mailgun.org include:_spf.salesforce.com include:spf.brevo.com include:mail.zendesk.com include:spf.mandrillapp.com -all
12 / 10
Example of an SPF record with too many lookups
What we read

Eight checks, one answer

Everything comes from public sources: DNS via 1.1.1.1, registration data from the registry and the certificate from the web server. No login, no test message.

SPF
Who may send mail in your name - and whether the record has passed the limit where it stops applying
DKIM
Whether your mail is signed, which selector is used and how long the key is
DMARC
What happens to forged mail, and whether the policy is actually switched on
MX
Where your incoming mail is delivered
Registration
When the domain stops being yours - the fault that takes everything down at once
DNSSEC
Whether your DNS answers are signed and cannot be forged in transit
MTA-STS
Whether senders are forced to encrypt when they mail you
TLS certificate
When the certificate on the website expires, and who issued it
How it works

From domain name to fix

1
Enter the domain
The answer takes a few seconds.
2
See what is wrong
Every finding is explained in plain language, with why it matters.
3
Fix it yourself, or let us
You get the exact DNS record to paste - or we make the change for you.
Pricing

The check is free. The watching costs.

Settings break quietly. Certificates lapse, providers change, someone edits a record. Monitoring, coming soon, will check your domain every day and tell you when something moves.

Check
0 kr
always
  • All eight checks
  • An explanation for every finding
  • The exact DNS record to paste
Run a check
Recommended
Monitoring
Coming soon
get in touch and we will tell you more
  • One domain
  • Checked every day
  • An email when something changes
  • Warning before certificates and registration lapse
  • History of changes
Get in touch
Agency
Coming soon
get in touch and we will tell you more
  • Up to 25 domains
  • Everything in Monitoring
  • One view across all clients
  • Monthly report as PDF
  • Priority support
Get in touch

If you want help making the change we do it for you.Price quoted once we have seen your setup.

Questions

Frequently asked questions

Do you send a test message?
No. We only read what is published in DNS and fetch the certificate from the web server. Nothing is sent to or from your domain.
Do I need to give you access to anything?
No. Everything we read is public. The check works on any domain, including one you do not own.
What does it mean that I am exposed?
That receiving servers have no instruction on what to do with mail claiming to come from you. Without one, a forgery usually lands straight in your customer's inbox. This is how invoice fraud normally starts.
Why does my mail go to spam when everything shows green?
The usual cause is a sender missing from your SPF record. Your normal mail goes through an authorised provider, but the invoicing system or booking tool sends from a different server nobody added. The settings look right - it is that one sender failing.
Can I protect one address but not another?
No. SPF and DMARC apply to the whole domain, not individual addresses. To separate the traffic you need a dedicated subdomain for it - for example billing.yourcompany.se with its own records.
What happens if I set p=reject straight away?
You risk having your own mail rejected. If an invoicing system or a booking tool is not authorised in your SPF, its mail stops arriving. Start at p=none, read the reports for a month, then tighten.
Why not just say DKIM is missing?
Because we cannot know that. A DKIM key sits under a name the provider chooses, and DNS cannot list which names exist. We try the common ones and say plainly when we find nothing - rather than claiming it is absent.
How long before a change shows up?
Usually within an hour, sometimes up to a day. It depends on how long your old record is allowed to sit in intermediate servers. Run the check again the next day if it has not taken effect.
Can you change my settings for me?
Only if you ask. You add a temporary user at your DNS provider, we make the change, and you remove the user when it is done. You keep ownership throughout.
Do you store the domains I search?
Only in a technical cache for up to seven days, so the registry isn't asked the same thing over and over. The cache isn't linked to you. We build no lists, sell nothing on and never use the searches to contact anyone. No tracking.

Check your domain now

It takes seconds and costs nothing.

Go to the check