Common questions

It reads the public settings your domain publishes about email and checks them against the published rules. In plain terms: which services are allowed to send as you, whether your messages can be verified, what receiving servers should do about fakes, where your incoming mail goes, and whether mail sent to you has to travel over an encrypted connection.

They do not change on their own, but they change more often than people expect. Someone connects a new marketing or support tool, a provider updates an address, a certificate expires, or a DNS record gets edited during unrelated work. Nothing announces any of this, and mail usually keeps flowing at first, so problems get found weeks later.

It is the list of services allowed to send email using your domain. Receiving servers check the sending server against that list. If a service is missing from it, messages from that service look no more trustworthy than a fake.

It is a signature added to your messages so receiving servers can confirm the message really came from your systems and was not altered on the way. The signature is checked against a key published in your domain settings.

It is the instruction you publish telling receiving servers what to do when a message claims to be from your company but fails the other checks. You can ask them to do nothing, to treat it as suspicious, or to reject it. It also asks them to send you reports about what they saw.

It is a way of telling other mail servers that messages sent to you must travel over an encrypted connection to a server you have approved. It protects mail coming in to you rather than mail going out.

It asks other mail servers to send you a summary when they could not open a secure connection to your mail servers. Without it those failures are invisible to you.

No, and be careful with anyone who says otherwise. Whether a message reaches the inbox depends on your content, your sending history, how recipients react to your mail, and rules each provider keeps private. Correct settings are one input among several. We check the settings and we do not model the rest.

No. It has no way to. We only read public settings, exactly as any mail server on the internet does. Changing your DNS would require credentials to your DNS provider, which we never ask for and deliberately do not want.

Not for the free check. Everything it reads is already public. Monitoring will need you to prove you control the domain by publishing a record we give you, because it involves showing you data about your own sending that should not be visible to strangers.

It can see everything your domain publishes about email, which is quite a lot. It cannot see your message signing keys unless it happens to guess their names, because those are stored under names that cannot be listed from outside. Any public checker has this limit. We say so in the report rather than presenting a gap as a clean result.

Because the problems that hurt are the ones nobody noticed. A check tells you about today. Monitoring notices the week a new tool pushes your sender list over its limit, or the month a website move quietly breaks your secure delivery policy. Those are the situations where finding out early is worth something. Monitoring is not built yet, so today the honest answer is that you would check manually.

Once monitoring exists, it will send you an alert describing what changed and what it means. Alerts will be based on meaning rather than the raw text of a record. Protection being weakened matters and you will hear about it. The same records coming back in a different order means nothing and will never generate an alert. None of this is available yet.

Not in the sense that phrase usually implies. It does not scan for threats, watch traffic, or detect attacks. It checks whether a specific set of email settings are configured the way the standards say they should be. Those settings do make it harder for someone to send convincing email pretending to be you, which is a real benefit, but it is one narrow thing rather than protection in general.

No. Reports are private to whoever has the link, they expire after 24 hours, and search engines are told not to list them. The underlying settings are public information, but we do not think a searchable index of other companies’ problems is a reasonable thing to build.

It is a small independent product. There is a contact page, and questions about a finding are welcome, especially if you think one is wrong. Being wrong about a result is the worst thing this product could do, so reports of it get looked at first.