What this screen is for
The home page exists to answer one question: is anything wrong with my domain's email setup right now? You type a domain, we read what it publishes in public DNS, and thirteen checks come back with a plain-language finding each.
Everything else on the page - the three-record explainer, the three steps, the example of a DMARC record that does nothing - is there to make the result readable when it arrives.
What each control does
- Domain
- The domain you want checked, such as
yourcompany.com. Enter the domain itself, not an email address and not a full web address - if you paste one of those we take the domain out of it. - Check domain
- Runs the check. It takes a few seconds because it is doing real DNS lookups, including following your SPF include chain.
- google.com / mailguardhq.com / example.com
- Sample domains, checked live exactly like any other. They are there because they land in visibly different places: one enforces DMARC, one passes everything critical with hardening left to do, one has outright failures.
- Check your domain free and Check a domain
- Both lead to the same panel. Check a domain sits in the site header on every page on a wide screen, so a check can be started from anywhere; on a narrow screen the header drops it for room, and the home page is the way back.
How to read the result
Each row is one check. The pill on the right is its verdict and the text under the name is the finding - what we saw, in words, followed by what to do about it where there is something to do.
- Pass
- Configured, and configured correctly.
- Warn
- Present but weaker or more fragile than it should be. Worth fixing, not an emergency.
- Fail
- Missing, broken, or actively doing nothing. This is where to start.
- Not applicable
- This check does not apply to this domain - a domain that receives no mail needs no MX record. It is left out of the score entirely, and it is never counted as a failure.
The dial is a score out of 100 with the checks weighted by how much they matter: the three authentication checks carry the most, hardening the least. Its colour follows the grade the check service returns.
Every check has its own help page explaining what it is, what going wrong actually costs you, and what to do.
What to do next
- Fix the failures before the warnings, and within the failures start with the authentication group - SPF, DKIM and DMARC carry the weight for a reason.
- If you have a DMARC record with no reporting address, add one. It changes nothing about how your mail is delivered, so it cannot break anything, and it is the only way to find out who is sending as you.
- Re-run the check after each change. DNS caches, so give it a few minutes.
What this screen does not do
A point-in-time read of public DNS
The check reads what your domain publishes publicly, at the moment you press the button. It does not send mail, read any mailbox, connect to your mail servers, or change anything at all.
It is not monitoring. It cannot tell you who has been sending mail as you - only the DMARC reports collected over time can do that, and collecting them is on the roadmap rather than built.