Why is my email going to spam?

Nine times out of ten it is authentication rather than content. If your domain has no SPF record, no DKIM signature or no DMARC policy, receiving servers have no way to tell your mail from a forgery, so they treat it cautiously. Run the check: if any of the three is missing, fix that before you rewrite a single subject line. The other common cause is a sender that is not covered. Your mail from Outlook passes, but the invoices your accounting software sends as you do not, because it was never added to SPF and never signed. DMARC reports are how you find those.

What is the difference between SPF, DKIM and DMARC?

SPF lists the servers allowed to send mail as your domain. DKIM adds a cryptographic signature to each message so the receiver can confirm it is genuine and unaltered. DMARC ties the two together: it tells receivers what to do when a message fails both, and asks them to report back on who is sending as you. You need all three. SPF alone breaks on forwarded mail, DKIM alone gives receivers no instruction, and DMARC without the other two has nothing to act on.

Is this domain check free?

Yes, with no account and nothing to install. A fair-use limit stops the tool being used for bulk lookups, but ordinary use — your own domains, or a client's before you take them on — will never reach it.

Does this change anything on my domain or my DNS?

No. Every part of this is a read. DNS queries, one TLS connection to read the certificate, one request to your homepage and a lookup at the registry. Nothing is written, nothing is sent as you, and no mail is generated.

Do I have to give you my email address?

The score and the headline findings appear immediately. The full record-by-record detail and the fix list are behind an email address. You are asked once.

The check found no DKIM key. Does that mean DKIM is broken?

Not necessarily. DKIM selectors cannot be listed from DNS — a scanner can only guess names and ask. This check probes the selectors the major providers use, so a custom selector will not show up even though it is working perfectly. To be sure, send a message to a Gmail account, open it, choose Show original, and look for DKIM: PASS. If it says none or fail, DKIM really is unset and your provider's admin panel will have the record to publish.

My domain is on a blacklist. What do I do?

First work out which address is listed. A listed mail server means your messages are being rejected right now and needs immediate attention. A listed web server address on shared hosting usually means a neighbour on the same IP and has little effect on your mail. Then find the cause before requesting removal — a compromised mailbox sending spam, a contact form with no rate limiting being used as a relay, or a plugin mailing thousands of messages at once. Every list has a delisting form, but if the cause is still there the listing comes back within days and repeated delisting requests are taken less seriously each time.

How often should I run this?

Every quarter for a stable domain, and immediately after any of these: adding a new tool that sends mail, changing mail provider, moving hosts, or changing nameservers. Those four changes account for most of the broken records this tool finds. If you have just moved to p=quarantine or p=reject on DMARC, check weekly for the first month.

Free domain health checker

Most domains have something quietly wrong with them. An SPF record that stopped working when the fourth sending service was added. A certificate that validates on your laptop and fails on a phone. A DMARC policy set to monitoring two years ago and never tightened.

None of it announces itself. Mail keeps leaving, the site keeps loading, and nobody finds out until a client says they never got the invoice.

Enter a domain below. You will get a score out of 100, every problem found in plain English, and the exact fix for each one.

What the checker looks at

Six categories, scored and weighted.

DNS records

Every record type, grouped and annotated. Each IP address is labelled with the network that owns it, so you can see at a glance whether you are on Cloudflare, AWS or a shared host. Every TTL is shown in both seconds and human time, because "3600" and "one hour" mean different things when you are planning a migration.

It flags the problems that break things: a CNAME where the standards forbid one, a single nameserver, a missing www, TTLs long enough to make a server move painful.

SSL certificate

Expiry, issuer, which names it covers, and whether the chain validates. That last one catches the case that wastes the most time: a certificate that looks fine in desktop Chrome, because Chrome caches the intermediate certificate your server forgot to send, and fails on mobile browsers and payment gateways that do not.

Reputation

Whether your web server and mail servers appear on DNS blacklists. A listed mail server means messages are being rejected right now.

Email authentication

SPF, DKIM, DMARC, BIMI and MTA-STS. The SPF check counts DNS lookups recursively and follows every include, which matters because the ten-lookup limit is the failure almost nobody catches. Go over it and SPF stops working entirely, silently, for everyone.

DMARC is checked for policy strength and whether reports are actually being collected. A policy with no reporting address is a policy nobody is reading.

Website and security headers

Response code and speed, whether HTTP redirects properly to HTTPS, and the security headers — HSTS, CSP, clickjacking protection. It also identifies the platform, so a WordPress site announcing its exact version in the page source gets told about it.

Registration

Registrar, expiry countdown, transfer lock and registry status. An expired domain takes the website and every email address with it, and recovering one after the redemption period is expensive when it is possible at all.

Who this is for

You inherited a website and do not know what is configured. Run the domain. The report tells you who hosts the DNS, who handles the mail, when the domain expires and what is broken, in about ten seconds, without a single login.

Your email is going to spam. Start with the email authentication section. In our experience it is SPF, DKIM or DMARC roughly nine times out of ten.

You are about to move a site. Check the TTLs before you start, not after. Once a 24-hour TTL is cached, you cannot shorten it retroactively — you just wait.

You are handing a site to a client. The report is a clean pre-launch checklist, and it prints.

Common questions

What is a domain health check?

A set of technical tests across everything a domain depends on: DNS records, email authentication, the SSL certificate, registration status, how the website responds, and whether your servers are on any blacklists. It finds the misconfigurations that break email delivery or browser trust without producing any visible error.

How do I check if SPF, DKIM and DMARC are set up correctly?

Run your domain through the checker above and read the email authentication section. It shows your published SPF record and how many of the ten permitted DNS lookups it uses, your DMARC policy and whether reports are being collected, and any DKIM key it can find. Each problem comes with the record you need to publish to fix it.

Why are my emails going to spam?

Usually one of three things: no SPF record, no DKIM signature, or a DMARC policy that tells receivers to take no action. Gmail and Yahoo both tightened their requirements for bulk senders in 2024, and domains that were fine for years started getting filtered. The email section of the report will tell you which of the three applies to you.

What does "SPF too many DNS lookups" mean?

The SPF standard allows ten DNS lookups when evaluating your record, counted across every include it references, and each of those can reference more. Every sending service you add pushes the count up. Cross ten and receiving servers return a permanent error, which means SPF fails for all your mail, everywhere, with no warning. This checker counts them recursively and tells you the number.

My SSL certificate works in Chrome but not on my phone. Why?

Almost always a missing intermediate certificate. Desktop Chrome caches intermediates it has seen elsewhere and quietly fills the gap; mobile browsers, payment gateways and API clients do not. The fix is to install the full chain file rather than just the certificate. The SSL section catches this specifically.

How often should I run a check?

Is it free?

Yes. The full report is free, and there is nothing to install. We ask for an email address to unlock the complete fix list, and that is the only thing we ever ask for.

Do you store the domains I check?

We keep the domain name and its score so we can serve the report quickly if someone checks it again. We do not store anything from inside your DNS, your mail configuration or your website, because the tool only reads what is already published publicly.

Want these fixed properly?

We have been building and repairing WordPress sites for over eight years — DNS migrations, email authentication, Core Web Vitals, malware recovery. If the report turned up more than you want to deal with, send us the domain, and we will quote on putting all of it right.