Is Your Domain's DNS Actually Configured Right?

SPF, DKIM, DMARC, DNSSEC and more, graded in plain English, with the exact records to fix what's wrong.

Reads your public DNS records only. Nothing stored unless you request the fix report.

The records that decide whether your email and domain are trusted

Ten or so DNS records quietly govern whether your email reaches inboxes and whether your domain can be impersonated: SPF and its hidden 10-lookup limit, DKIM signing, DMARC and its subdomain policy, MTA-STS, TLS-RPT, DNSSEC, CAA and MX. Most small business domains get two or three right and leave the rest missing or misconfigured, which is why their invoices land in spam and their name is easy to forge. This analyser reads all of them and grades each in plain English. Request the report and we email you the exact records to paste in, in the order to do them.

Would rather it were simply configured correctly? We set up SPF, DKIM, DMARC and the rest as part of managed IT, or as a one-off. Pair this with the email security checker and the blacklist monitor.

Frequently asked questions

What does this analyser check?

SPF (including whether it exceeds the 10 DNS-lookup limit that silently breaks it), DKIM signing keys, DMARC policy and subdomain policy, MTA-STS, TLS-RPT, DNSSEC, CAA and MX. It grades each and, in the emailed report, gives you the record to add or fix.

Why does the SPF lookup limit matter?

SPF is only allowed 10 DNS lookups. Each include: (and a, mx, etc.) counts, and nested includes add more. Go over and SPF returns a permanent error that receivers treat as no SPF at all, so your carefully-built record does nothing. Many businesses quietly exceed it after adding a few email tools.

Is MTA-STS, TLS-RPT, DNSSEC or CAA essential?

No, they are hardening extras, so we mark them as 'consider' rather than 'fail'. SPF, DKIM and DMARC are the ones that directly affect whether your mail is trusted and delivered; do those first.

Will you change my DNS for me?

Not from the tool. The report gives you paste-ready records to apply yourself, or reply to it and we will configure everything for you, as a one-off or as part of managed IT.

How current is the result?

It reads your live DNS at the moment you run it, via a fast public resolver. If you have just made a change, allow a few hours for it to propagate before re-checking.