How healthy is your domain?

When a domain publishes a DMARC record with an rua address, mailbox providers such as Google, Microsoft, and Yahoo send a daily zipped XML report to that address. Each report lists the servers that sent mail as your domain and whether that mail passed SPF and DKIM alignment. They are accurate and almost unreadable, which is why most domains never look at them.

Only DMARC report emails. It runs one fixed search for messages with a report-style subject and a .xml, .gz, or .zip attachment, then reads the sender, subject, date, authentication headers (Authentication-Results and ARC), and those attachments. It never reads other mail or any message text. The exact query is on the Gmail page, and you can disconnect at any time.

Every account gets a report address of the form token@rua.dnsautopilot.com. Add it to the rua tag of your _dmarc record and reports arrive there directly. It works with any mailbox, and it is the better route when the mailbox belongs to a client or a shared inbox.

It looks only at reports it can verify came from the reporting provider, and it leaves known forwarders out of the count. A domain is ready for quarantine when at least 98 percent of the mail from known senders passed for 14 days with no sender left to fix, and ready for reject on the same test over 30 days. It also needs at least 500 messages from at least two reporters in that window. Each result lists the reasons in plain sentences.

Parsed reports and their raw attachments are kept for 25 months. Gmail message ids, used only to avoid importing a report twice, are kept for 60 days. You can delete everything from Settings at any time, including the Gmail connection and the stored reports.

Pro starts with a 14-day trial that needs a card and includes Gmail connect. Cancel from Billing at any time: you keep the plan until the end of the period you paid for, and a trial cancelled in time is not charged. There is no contract.

No. Enter a domain on the check page and in about three seconds you get a score from 0 to 100 across more than 40 checks: DMARC, SPF, DKIM, MX, reverse DNS, blocklists, STARTTLS, MTA-STS, TLS-RPT, DNSSEC, CAA, the HTTPS certificate, and registration. Each problem comes with the exact record to publish. It is limited to 20 checks an hour per visitor.

Every check passes, warns, or fails. They fall into five areas, and the overall score weights them: email authentication 35%, mail servers 20%, mail in transit 15%, DNS security 15%, and domain and website 15%. Each fix shows the points it adds, and the fix plan shows the score you would reach with all of them applied.

Small businesses that send mail through a handful of services such as Google Workspace, a CRM, a newsletter tool, and a store, and the agencies and IT providers that run email for them. The Agency plan groups domains by client and sends a digest per client.

It can if a real sender is not aligned, which is why DNS Autopilot only says a domain is ready when known senders pass and no known service is still failing. Go in steps: p=quarantine first, then p=reject. Each step comes with the exact record to publish, and you can go back to the previous policy by editing the record.

With Gmail connect, no: reports are read from your mailbox. With the report address you change one thing, the rua tag of your _dmarc record, to include token@rua.dnsautopilot.com. DNS Autopilot only reads public DNS records and never changes them; you publish any later policy change yourself.

Yes, through the report address, which works with any mailbox and any DNS host. Gmail connect is for Google mailboxes only. Microsoft 365 mail is recognized as a sending source, and the setup guide lists where to edit the DMARC record at common DNS hosts.

Yes, on the Agency plan: up to 100 domains, grouped by client, with a weekly digest per client. Point each client's rua tag at your report address, or connect a mailbox that already receives their reports.

Yes. It names the service behind each sending IP, shows whether SPF or DKIM aligned, and says what to change when it did not. It also checks your SPF lookup count against the limit of 10 and the DKIM keys for the selectors seen in your reports.