Email Domain Health

Open Email Domain Health

Email Domain Health, the PirateSERP email authentication checker, reads the public DNS records that mailbox providers use to decide whether mail from a domain is genuine. It lists what to fix, most serious first. Email Domain Health needs no API key.

Run it on your own domain before you start a campaign or change your email provider, and on a client's domain when their mail lands in spam.

Check a domain

1. Review Domain or email address, or enter a domain such as example.com. An email address such as jane@example.com also works. The active project's business website can fill this field.
2. Click Check domain.
3. Read the findings, then review the DNS records table.

Read the findings

Each finding has a label:

• Fix means mail from the domain can fail checks or be spoofed today. Examples: no SPF record, two SPF records, an SPF record that needs more than 10 DNS lookups, or no DMARC record.
• Check means the setup works but leaves a gap. Examples: DMARC in monitoring mode (p=none), DMARC with no report address, or a service that the domain is verified with but that SPF doesn't list.
• Note means information worth knowing, such as a BIMI logo that won't show until DMARC is enforced.

Open a finding to read what it means and what to change.

When you check a subdomain such as news.example.com that has no DMARC record of its own, Email Domain Health shows the parent domain's DMARC record, marked inherited from, because mailbox providers apply the parent's policy to it. If the domain doesn't exist at all, the result says so instead of listing missing records, so check the spelling.

Read the DNS records table

• Found means the record exists. For SPF, the value shows how many of the 10 allowed DNS lookups the record uses.
• Missing means the domain publishes no SPF or DMARC record, or no MX record.
• Not set means an optional record isn't published: MTA-STS and TLS reporting protect mail in transit, and BIMI shows your logo in some inboxes.
• Not found appears only for DKIM. Email Domain Health checks the selector names that common email services use. Many services use their own names, so "Not found" doesn't mean DKIM is off. Check your email provider's settings to confirm it.
• Revoked means a DKIM key exists but is empty, so messages signed with it fail.
• Couldn't check means the lookup failed. Run the check again in a few minutes.

Services verified on this domain lists email services whose verification records the domain publishes. A verification record shows that someone set the domain up with that service, not that the service sends mail today. Confirm with the team before you add a service to SPF or remove its record.

Tighten DMARC safely

Don't jump straight to p=reject. Start with p=none and a report address (rua), read the reports for a few weeks, fix every real sender that fails, then move to p=quarantine and finally p=reject. Run Email Domain Health after each change.

Email Domain Health keeps no check history. Run the check again after you change a DNS record; most changes are visible within an hour.