Check a domain

A public check reads the authentication records any domain publishes in DNS. It needs no account, no ownership proof and changes nothing.

What the check reads

1. SPF: the servers allowed to send as the domain.
2. DMARC: the policy for failing mail and where reports go.
3. MTA-STS and TLS reporting: whether mail to the domain must use encrypted connections, and where connection reports go.
4. BIMI: the logo record, if any.

DKIM needs a selector

DNS cannot list a domain's DKIM keys. Each sending service publishes its key under a name called a selector, such as s1 or google. Add a selector you know to check that key; without one, DKIM shows as unknown, not missing.

What a check cannot tell you

A check shows what is published, not how your mail fared. Reports from receiving servers show whether it passed authentication and what they say they did with mail that failed; neither proves inbox delivery. For reports, add the domain for monitoring and connect DMARC reports. Run the check at /check, from Domains in the workspace, or at /api/v1/check.