Give every client a monthly domain health report card.
White-label domain and DMARC monitoring for WordPress care plans, small MSPs and agencies, with a monthly report card for each client carrying your logo. You spot problems before your clients do, and bill for the peace of mind.
- 28-day free trial on up to 3 domains
- No card needed
- Hosted in the EU
- Domain registrationPass
- HTTPS certificatePass
- DNS recordsPass
- Mail serversPass
- SPFImprove
- DKIMImprove
- DMARCPass
- MTA-STSImprove
- BlacklistsPass
- DMARC
- SPF
- DKIM
- HTTPS certificate
- Domain registration
- Blacklists
- MTA-STS and TLS-RPT
- Mail servers
- DNS changes
How domain monitoring worksSet it up once. It runs itself after that.
- 1
Add your domains
Paste a list or import a CSV, and group domains by client. Nothing to install, and no DNS changes needed to start.
- 2
We check every day
Expiry, HTTPS, DNS changes, SPF, DKIM, DMARC, MTA-STS, mail servers and blacklists. Every domain gets a grade from A to F.
- 3
Clients get a report card
Every month, each client receives a two-page PDF with your logo and colours, and the fixes that matter most.
White-label client report cardYour logo on it. Your invoice line for it.
Two pages your clients will actually read: an overall grade, how it has moved over six months, what changed, and the three fixes that matter most. All in plain English, sent every month.
- Your logo and colours, sent under your agency name with replies coming to you
- On Agency and Pro, choose the day they go and review each one first
- On Pro, nothing on it mentions us at all
- Grades use shape as well as colour, so they print cleanly in black and white
Domain health report gradesA grade a client understands in a second.
Every domain gets a score out of 100 from weighted checks, with email authentication counting most. An A means a perfect 100: nothing left to fix. Each grade has its own shape, so it still reads when printed in black and white.
- 100Excellent. Perfect: nothing to fix.
- 90 to 99Good. Minor things to tidy up.
- 80 to 89Fair. Several things to improve.
- 70 to 79Poor. Something important needs fixing.
- 60 to 69Weak. Several important things need fixing.
- Below 60Failing. Urgent attention needed.
Domain and DMARC monitoringThe things that quietly break a client's website or email, watched for you.
Expiry and HTTPS alerts
Hear about a lapsing domain 30 days out and a certificate 21 days out, long before a website goes offline.
DNS change detection
See which record changed, when, and what it was before. Mark expected changes so they stop showing.
Email authentication
SPF, DKIM, DMARC and MTA-STS checked daily, including SPF lookup counts and DKIM key length.
DMARC and TLS reports
Reports turned into a clear list of every service sending as the domain, and whether it passes.
Blacklist monitoring
Know the day a mail server or sending address appears on a blacklist, with steps to get it removed.
Alerts by email and webhook
Straight away or as a daily digest. Signed JSON webhooks feed your helpdesk, chat or automation tool.
Hosted DMARC, SPF and DKIMFix it for them, don't just flag it.
Point a client's records at us once and manage DMARC, SPF, DKIM, MTA-STS and TLS-RPT from your dashboard. Tighten a DMARC policy or add a new sender without asking for their DNS login again.
- Hosted DMARC. Move from none to reject in steps, with reports coming straight to you.
- Hosted SPF with flattening. Stay under the 10-lookup limit, re-checked every 6 hours.
- Hosted DKIM. Delegate _domainkey to us, import existing keys and keep them checked.
- Hosted MTA-STS and TLS-RPT. Policy file and certificate served for you.
One-click set-up on Cloudflare
Cloudflare only for nowIf a client's DNS is on Cloudflare, press Set up with Cloudflare, approve the change in Cloudflare's own dashboard, and the records are added for you. We never see or keep a Cloudflare login or API token.
- Covers domain verification, hosted DKIM, DMARC, TLS-RPT and MTA-STS. Hosted SPF is still one record you add by hand.
- Works on any Cloudflare account. With other DNS providers you copy the records across, and the app shows exactly what to add.
PricingPriced by domain count, not by check.
Every plan includes every check, hosted records, alerts and report cards.
Starter
- Up to 25 domains
- 2 team members
- Report cards with your logo and colours
- Sent at 6am on the 1st
- 250,000 DMARC messages a month
Agency
- Up to 75 domains
- 5 team members
- Choose the day and hour they go
- Review each one before it's sent
- 500,000 DMARC messages a month
Pro
- Up to 200 domains
- Unlimited team members
- Fully unbranded: nothing mentions us
- Choose the day, and review first
- 750,000 DMARC messages a month
HEALTH50Launch special: 50% off your first 12 months. Use the code by 31 Mar 2027.Compare plans
Email deliverability testSend one email. See exactly how it was judged.
Free for anyone, with no sign-up. With an account, your workspace gets its own test address to hand to clients, and the report they get back carries your branding.
A free email test, for anyone
Get a test address, send it one email, and see how it authenticated: SPF, DKIM and DMARC alignment, TLS, reverse DNS, headers and blacklists, plus the sending domain's grade. We throw the message away and never keep its subject or content.
Try the free email testYour own branded test address
Claim an address for your workspace, such as youragency@check.domainhealthhub.com, and give it to clients. When one sends it an email, they get the report back under your name and branding, the same as their report card, and every test shows in your dashboard.
Reports are emailed back only when the email passes DMARC with an aligned DKIM signature, once per domain per day.
Who it's forBuilt for people who look after other people's domains.
Web agencies
Check every client domain daily and send each client a report card with your logo.
For web agenciesMSPs
DMARC, SPF, DKIM, SSL and expiry for up to 200 client domains, priced by domain.
For MSPsFreelancers
Up to 25 client domains watched daily, with a monthly report card in your name.
For freelancersWordPress care plans
Add domain renewals, certificates and email health to the care plan you already sell.
For care-plan providers
GuidesEmail authentication, explained plainly.
All guidesWhat is DMARC? A plain-English guide for agencies
What DMARC does, how it works with SPF and DKIM, what none, quarantine and reject mean, and how to move a client to reject safely.
Read the guideSPFSPF explained, and the 10-lookup limit
How SPF works, why records quietly break as clients add new services, and how to fix a record with too many DNS lookups.
Read the guideDKIMDKIM explained: selectors, keys and rotation
How DKIM signing works, how to find a domain's selectors, why 1024-bit keys get flagged, and how to change keys without a gap.
Read the guideDomain Health Hub FAQ
Anything else? Pricing questions are answered separately.
Will my clients see your name?
On Pro, no: the report card carries only your logo and colours. On Starter and Agency, a small "Monitored with Domain Health Hub" line sits in the footer.
How is the grade worked out?
Each domain gets a score out of 100 from weighted checks, with DMARC counting most, then SPF, DKIM and the HTTPS certificate. A is a perfect 100, B is 90 to 99, C 80 to 89, D 70 to 79, E 60 to 69 and F below 60. A domain that has expired or doesn't exist in DNS is always an F.
Do I need to change my clients' DNS?
Not to get started. Every check reads public DNS. To see who sends email as a domain, add its reporting address to the DMARC record, or let us host the record for you.
Can I charge clients for the reports?
Yes. The report card is yours to price however you like, for example as part of a monthly care plan or support contract.
What happens when the trial ends?
Choose a plan to carry on. If you don't, checks, alerts and report cards stop until you do. Records we host for you, and incoming DMARC reports, keep working for 30 days, so your clients' email isn't affected while you decide, and we email you before we withdraw them. After 90 days without a plan, the workspace and its data are deleted.
Do you offer data processing terms?
Yes, they're part of our terms of service, under "Your clients' data". For your clients' details and the reports we receive for their domains, you are the controller and we are your processor under UK GDPR. They cover confidentiality, security, breach notice, the providers we use and deletion.
Can I cancel at any time?
Yes, from Billing, with no notice period. Your plan carries on until the end of the month you've paid for, and we don't refund part months.
Where is my data kept?
On our own servers in the EU, with backups in the Netherlands. DMARC and TLS reports are read for their totals and then deleted, and we never accept forensic reports.
See your first grade in seconds.
Then start a 28-day trial and send your first report card.