How it works
Once a day, we check the DNS records that stop others from sending email in your name:
- SPF lists the servers allowed to send mail for your domain. It must be a single record that does not allow everyone (
+all) and needs at most 10 DNS lookups. Above that, receivers treat it as invalid. - DMARC tells receivers what to do with mail that fails SPF and DKIM. A policy of
p=noneonly monitors, andpctbelow 100 applies the policy to part of the mail only. - DKIM signs your mail. We look for common selectors (
google,selector1,selector2,default,k1and others), or the one you set, and flag keys shorter than 2048 bits. - BIMI, if present, is shown in the report.
Domains that send no email at all still need v=spf1 -all and a DMARC policy of p=reject, or spammers can use them freely.
Settings
| Setting | Default | What it does |
|---|---|---|
| DKIM selector | — | Your DKIM selector, e.g. google. When it is set, a missing DKIM record warns. |
Statuses
| Status | Meaning |
|---|---|
| OK | SPF and DMARC protect the domain. |
| Warning | No SPF or DMARC record, a neutral SPF (?all), a DMARC policy of none or below 100%, a missing DKIM record for your selector, or a weak DKIM key. |
| Failed | Several SPF records, an SPF that allows anyone, or an SPF over the 10-lookup limit. |
By default you are notified of failures only.
Fixing common problems
- No SPF: add a TXT record such as
v=spf1 include:_spf.google.com -allwith your email provider's include. Without email:v=spf1 -all. - Several SPF records: merge them into one record.
- Too many lookups: remove includes you no longer use, or replace them with the provider's IP ranges (
ip4:). - No DMARC: add a TXT record at
_dmarc.yourdomain, such asv=DMARC1; p=none; rua=mailto:dmarc@yourdomain. Read the reports for a few weeks, then move top=quarantineand finallyp=reject.