EmailCheckup

Reading your domain scan results

The scan on the home page reads the same public DNS records every mail server reads when a message claims to come from your firm. Here is what each line means.

Run the domain scan

What the colours mean

  • Pass The record is there and set the way we'd expect for a firm.
  • Watch It exists but has a gap, or we couldn't confirm it from outside. Worth a look.
  • Fail Missing or set in a way that lets someone else send as you.
  • Note Information only, or an optional record. Not a problem on its own.

Each check, line by line

  • Mail servers

    Your MX records, and from them, who handles your mail: Microsoft 365, Google Workspace or a filtering service. This tells us how DKIM should be set up. A domain with no MX records doesn't receive mail, and should say so with v=spf1 -all and a DMARC reject policy.

  • SPF

    A single TXT record such as v=spf1 include:spf.protection.outlook.com -all listing who may send as you. It fails if there are two records, if it ends in +all or ?all, or if following its includes takes more than 10 DNS lookups. Eight or more gets a Watch: there's little room left to add a service.

  • DKIM

    Public keys at selectors like selector1._domainkey or google._domainkey. We can only check common selectors from outside, so a Watch here means "confirm it", not "it's broken".

  • DMARC

    The record at _dmarc.yourfirm.ca. p=none reports but doesn't stop anything, so it gets a Watch. p=quarantine and p=reject pass, as long as reports go somewhere (rua=) and the policy covers all mail and subdomains.

  • DNSSEC

    Whether answers about your domain are signed. Without it, a resolver can't tell a forged answer from a real one. Most DNS hosts can switch it on quickly.

  • CAA

    Optional records such as 0 issue "letsencrypt.org" that limit which certificate authorities may issue certificates for your domain. Missing CAA is a Note, not a failure.

If you only fix one thing

Get DMARC to quarantine or reject, with reporting, without breaking legitimate mail. That is the record that actually stops someone sending invoices in your name. Getting there safely means finding every service that sends as you first: accounting software, newsletters, scanners, the CRM. That's the work KDTS does as DMARC monitoring and enforcement.

What the scan can't see

It reads public DNS only. Nothing is stored and nothing on your systems is touched. It can't tell you whether accounts have MFA, whether mail is quietly forwarding out of the firm, who holds admin rights, or whether anything is backed up. That's what the full checkup is for.

Want the inside view as well?

A one-minute form with your firm name, staff count and platform. We reply within two business days. Prefer email? [email protected]

Request a checkup