What the checks in the reports mean and how to fix them. Each heading appears under the same name in the report.
A TXT record that defines which servers may send email on behalf of your domain. The receiving server compares the sending IP address of an incoming message with this list.
The record starts with v=spf1 and ends with -all (reject anything not listed) or ~all (treat as suspicious). include:, a, mx, exists and redirect may trigger at most 10 DNS lookups; beyond that SPF is invalid (permerror). A domain must have exactly one SPF record.
v=spf1 include:_spf.google.com ~all
Adds a digital signature to outgoing email using a private key; the receiver reads the public key from DNS at selector._domainkey.domain and verifies the signature. It proves the message was not altered in transit and came from your domain.
The selector name is chosen by your email provider (google, selector1, k1, and so on). Our report tries common selectors; if your provider uses another name, "not found" may be shown. RSA keys should be at least 2048 bits.
Requires SPF and DKIM results to align with your domain and tells receivers what to do with failures: p=none monitor only, p=quarantine send to spam, p=reject reject. With rua= you receive daily aggregate reports.
Recommended path: start with p=none and watch the reports, add legitimate senders to SPF/DKIM, then move to quarantine and reject.
_dmarc.example.com TXT "v=DMARC1; p=quarantine; rua=mailto:[email protected]"
Forces server-to-server email connections to use TLS, protecting against man-in-the-middle attacks. It needs an _mta-sts TXT record and a policy file at https://mta-sts.domain/.well-known/mta-sts.txt. Start with mode: testing and switch to enforce once everything works.
Shows your logo next to the sender in mail clients that support it, for domains whose DMARC is quarantine or reject. The default._bimi TXT record contains the URL of a logo in SVG Tiny PS format. Optional.
Digitally signs DNS answers and prevents forged answers (cache poisoning). The chain of trust starts at the root: root zone → TLD → your domain. The digest of each zone's DNSKEY must appear in its parent zone as a DS record.
Common mistakes: DNSSEC is enabled at the DNS provider but the DS record is never entered at the registrar (broken chain), or an old DS remains after changing providers (the domain stops resolving). The latter is serious; the report shows it as "DS mismatch".
Defines which certificate authorities (CAs) may issue SSL certificates for your domain. Without a record any CA may issue. With iodef you are notified about rejected requests.
example.com CAA 0 issue "letsencrypt.org"
The authoritative DNS servers of a domain. There should be at least two, preferably on different networks (ASNs); if one fails the other still answers. The serial number in the SOA record should be the same on every server, otherwise servers are serving different versions of the zone.
TTL is how many seconds a record may be cached. Lowering the TTL before changing a record speeds up propagation.
Maps an IP address back to a hostname. For mail servers it is close to mandatory: without a PTR record, or if it does not match the A record, many receivers reject the email or treat it as spam. The PTR is set by the owner of the IP block (your hosting provider or ISP).
After you change a record, resolvers around the world keep the old value in cache until the TTL expires. The report asks 12 public resolvers the same question and compares their answers with the value on the authoritative server; resolvers returning a "stale value" will update when their TTL expires. If the authoritative server returns the correct value there is nothing for you to do.
Lists of IP addresses flagged as sources of spam or abuse. If your mail server's IP is listed, your email gets rejected. Removal requests go to the organization that runs the list; the links in the report take you to the right page. Spamhaus PBL is an "end-user IP range" list and does not mean you sent spam.
An autonomous system number is the identity of a network on the internet; ISPs, hosting companies and large organizations have their own ASNs. The ASN page shows the IP blocks a network announces and the countries it uses.