Domain and Email Health

Check the mail and DNS setup of public domains. Each domain gets one row: a score from 0 to 100, a letter grade, and a short list of fixes in plain language.

Not legal advice; general information only.

These findings flag likely issues. This is not a deliverability guarantee or a security certification.

What you get

For each public domain:

• Whether MX records are present, including a null MX that means the domain does not accept mail.
• SPF: whether a record exists, whether there is only one, whether it stays within the DNS lookup limit, and whether it ends in -all or ~all.
• DMARC: whether a record exists, the policy (none, quarantine or reject), the percent it covers, and whether an aggregate report destination is set. The destination address is not saved.
• DKIM: whether a record was found for each common selector, plus any extra selectors you add. A record with an empty key is revoked and does not count as found. Key material is not saved. If none of the common selectors has a key, the note says that a custom selector may be a false alarm.
• Whether MTA-STS, TLS-RPT and BIMI records are present.
• Whether DNSSEC is enabled.
• The domain expiry date and the registrar name, when the registry publishes them.

A domain that expires within Domain expiry warning days is called out, so a weekly schedule still leaves time to renew. The default is 21 days.

Unreachable domains are stored with no score and are not charged. Invalid names are skipped and are not charged. Private addresses, internal names, and addresses on a port other than 80 or 443 are skipped and are not charged. The summary counts every name you supplied, how many were accepted, and how many of those unsafe names were skipped. A run whose names are all private still finishes, with nothing checked.

What is not collected

Email addresses are never saved. That includes DMARC report destinations and anything in a registry contact record. Registrant names, postal addresses and phone numbers are not saved. DKIM public keys are not saved. DNS answers are not saved.

Tutorial

1. Paste domain names under Domains. Use the name that sends mail, usually the apex, such as example.com.
2. If your mail provider uses a selector that is not in the common list, add it under Extra DKIM selectors. Up to 10 names. Each one is a single DNS label.
3. Leave Domain expiry warning at 21 for a weekly run, or raise it if you want earlier notice.
4. Set Max domains if you want a hard cap on the bill.
5. Start the run. Open the dataset for one row per domain, or the REPORT record in the key-value store for the same findings as a page.

Weekly monitor

Create a schedule (for example every Monday) and save the input with your domain list. Each run charges the start fee plus one domain fee for every domain that resolved. A domain that does not resolve is listed and is free.

Pricing

You pay a small fee when the run starts, plus a fee for each public domain that could be checked.

Event	Price
Run start	$0.00005
Domain checked	$0.003

Examples

• 1 domain: $0.00305
• 10 domains: $0.03005
• A run where every domain is invalid or does not resolve: $0.00005

Input

Field	Default	What it does
Domains	empty	Public domain names to check. One row each.
Domain expiry warning (days)	21	Flag domains that expire soon.
Max domains	10	Cap how many domains one run will check.
Concurrency	2	How many domains to check at the same time.

Output

The overview table shows the score, the grade, MX, the SPF qualifier, the DMARC policy, how many DKIM selectors were found, DNSSEC, and the expiry date. The item also lists the fixes, highest impact first.

Limits

Up to 50 domains in one run. Lookups use public DNS. The registry expiry lookup follows only public HTTPS redirects.

Disclaimer

These findings flag likely mail and DNS issues. This is not a deliverability guarantee or a security certification. A high score does not mean every message will be accepted.