Free domain health checker
Nine checks on any domain's website and email set-up, a grade from A to F, and a plain-English fix for everything that needs one. No sign-up needed.
We don't keep a record of the domains you check. Results are reused for 10 minutes if the same domain is checked again.
What we check
- DMARCRecord exists and is valid, the policy (none, quarantine or reject), test mode, and where reports go.
- SPFOne valid record, DNS lookups within the limit of 10, and no +all or ?all.
- DKIMYour selectors, or common ones we look for. Key present and long enough.
- HTTPS certificateApex and www: expiry (warns at 21 days, fails at 7), a valid chain and a matching hostname.
- Domain registrationExpiry date from RDAP, including .uk domains. Warns at 30 days, fails at 7.
- BlacklistsMail server addresses against reputable blacklists.
- MTA-STS and TLS-RPTBoth records present, and the policy file served over valid HTTPS.
- Mail serversMX records resolve. Daily monitoring also checks the servers answer on port 25; the free checker doesn't connect to them.
- DNS changesName servers, website, mail and TXT records as they stand now. Daily monitoring compares them with the day before.
Understand the results
- What is DMARC?What DMARC does, how it works with SPF and DKIM, what none, quarantine and reject mean, and how to move a client to reject safely.
- SPF and the 10-lookup limitHow SPF works, why records quietly break as clients add new services, and how to fix a record with too many DNS lookups.
- DKIM explainedHow DKIM signing works, how to find a domain's selectors, why 1024-bit keys get flagged, and how to change keys without a gap.
- MTA-STS and TLS-RPTHow MTA-STS makes sure email to a domain arrives encrypted, how TLS-RPT reports problems, and how to switch both on safely.
- p=none to p=rejectA step-by-step plan for taking a client domain from DMARC p=none to p=reject, with exit criteria for each stage and what RFC 9989 changed about pct.
- Protecting parked domainsDomains that never send email are easy to spoof. Three DNS records lock them down: SPF -all, DMARC p=reject and a null MX. Copy them here.
- .uk renewals and expiryWhat happens to a .uk domain after its expiry date, day by day: Nominet's 30-day suspension, the 90-day renewal limit, and how to never get there.
- Selling domain and email healthFor agencies and MSPs: how to open the conversation, what to put in the proposal, how to price it, and how the monthly report keeps clients paying.
- Sender requirements explainedWhat Gmail, Yahoo and Outlook.com require from email senders: SPF, DKIM, DMARC, alignment, unsubscribe and spam rates, with the errors you'll see.
- How to read a DMARC reportWhat a DMARC aggregate report contains, how to read each part of the XML, the four patterns you'll see, and what to do about each one.
- Domain and email in a care planWhat a website care plan usually misses, what to check each month, what to put in the client's report, and how to price the domain and email part.
- After NCSC Mail CheckNCSC Mail Check and Web Check closed on 31 March 2026. What that means for a small business or charity's email and website, and what to use instead.