Does the domain health checker change my DNS?

No. It performs live DNS lookups and reports what is currently published.

What does the domain health checker scan?

It checks DMARC, SPF and DKIM records for the domain, then summarizes the results into separate scores for each authentication area.

What DMARC checks are included?

The checker looks for a DMARC record, confirms there is only one record, validates syntax, checks the main and subdomain policy, verifies aggregate reporting, and checks external reporting authorization.

What SPF checks are included?

The checker looks for an SPF record, confirms there is only one record, validates syntax, checks DNS lookup and void lookup limits, detects include loops, checks record length, verifies the all mechanism, flags +all, PTR, duplicate includes, empty includes, macros, and records with no authorized senders.

What DKIM checks are included?

The checker scans common DKIM selectors, checks whether records exist, confirms each selector has a single record, validates syntax, checks RSA compatibility, SHA-256 hashing, 2048-bit key strength, and whether testing mode is enabled.

Why does the report show separate DMARC, SPF and DKIM scores?

Each protocol protects a different part of email authentication. Separate scores make it clear whether the domain has a DMARC policy problem, an SPF DNS problem, a DKIM key problem, or a mix of issues.

Why can SPF or DKIM pass but DMARC still fail?

DMARC requires SPF or DKIM to pass and align with the From domain. A record can be valid but still fail DMARC if the authenticated domain does not match the visible sender domain.

Why does DNS provider detection matter?

Knowing where DNS is managed helps you route fixes to the right account or team. The checker shows provider context when nameservers make it possible to identify.

What should I fix first?

Fix missing or invalid DMARC, SPF, and DKIM records first. Then address SPF lookup limits, weak DMARC policies, missing reporting, and weak DKIM keys.

Can I share the domain health report?

Yes. Run a check and use the share link to send the same report to a teammate, client, or vendor.

Does this checker test a specific email message?

No. The domain health checker validates DNS records. To inspect whether a real email passed SPF, DKIM and DMARC alignment, use the email tester.

How do I monitor domain health over time?

A one time check is useful for audits and troubleshooting. For ongoing visibility into authentication failures, sender changes and DMARC reports, use DMARC monitoring.

Free domain health checker: scan SPF, DKIM and DMARC

Check your domain health across DMARC, SPF and DKIM

Full authentication scan

Run a live email authentication audit to find DNS issues, weak policies, lookup limit problems, and missing DKIM selectors in one report. For ongoing visibility, use Suped's DMARC monitoring to track authentication results, sender changes and domain health over time. If a check points to policy work, compare the DMARC tags and DMARC policy examples before changing DNS.

Get started

"This clarity allows us to take action faster whether it's adjusting content, fixing authentication, or addressing reputation issues. We've moved from reactive guesswork to proactive management."

John Porteous

Group IT Manager

One domain health checker, endless uses

Use the domain health checker to audit a new domain, review client DNS, troubleshoot authentication failures, or confirm a security rollout after propagation. It brings DMARC, SPF and DKIM checks into one readable report so you can see what passes, what fails, and what to fix first.

7/7

DMARC

16/16

SPF

7/7

DKIM

Combined health score

See DMARC, SPF and DKIM pass counts together before opening each detailed section.

DMARC policy

SPF record

DKIM selectors

Authentication coverage