What do you check in DNS, and what does a finding mean?

On every plan

We check the DNS records that decide how your mail is authenticated and delivered: DMARC, SPF, DKIM, MX, MTA-STS, TLS-RPT and BIMI. Your plan sets how often the checks run, and Check now runs them at any time. Each finding is a sentence in plain words, and the table at the end of this page lists every one with its fix.

What we check

• DMARC at _dmarc.example.com: the policy, and whether reports come to your reporting address.
• SPF at example.com: the record, every include under it, and the number of DNS lookups it needs.
• DKIM at <selector>._domainkey.example.com, for every selector we know of.
• MX at example.com: the servers that receive your mail.
• MTA-STS at _mta-sts.example.com, and the policy file at https://mta-sts.example.com/.well-known/mta-sts.txt.
• TLS-RPT at _smtp._tls.example.com: where TLS reports go.
• BIMI at default._bimi.example.com, and the logo and certificate it points to.

How often

When you add a new domain, we check its records once straight away, so its DNS tab shows what your DNS says before the domain is verified. If you remove a domain and add it again within your plan's interval below, that check is not repeated. Press Check now on its DNS tab to check it then. Once a domain is verified, we check its records on a schedule set by the plan:

• Starter: every 24 hours
• Pro: every 6 hours
• Teams: every hour
• Enterprise: every 15 minutes

A report that arrives also starts a check, at most every hour. A subdomain with a DMARC record of its own is checked on the same schedule as its domain.

Check now on a domain's DNS tab runs every check at once and asks the domain's own name servers, so a record you changed a moment ago shows up straight away. Any member can press it. For the same domain, it works again after 1 minute.

How to read a finding

Each record's card on the DNS tab is marked by its worst finding: a problem, a warning, a note, or fine.

A problem opens a DNS error alert, except when it only says we could not reach your DNS. For a few findings, the DNS tab also writes out the corrected record, ready to copy.

SPF lookups

A mailbox provider follows at most 10 lookups while it checks an SPF record (RFC 7208), and fails the check past that. We count every lookup through every include. A redirect counts only when the record has no all, because mailbox providers ignore it then. Above the limit you get a problem, and from 8 lookups a warning. More than 2 lookups that find nothing also give a warning. When we cannot read an included record, the card says so and the count is a minimum: the problem above the limit still shows, and the warning near it does not.

DKIM selectors

DNS has no list of a domain's DKIM keys. Each key sits under a name called a selector, so we look for selectors in three places:

• The selectors that signed your mail, as the reports show them.
• The selectors that the services among your sources document.
• A short list of common selectors, such as google, selector1 and k1.

The DNS tab shows where we learned of each selector. A selector that has not been in a report for 90 days and has no key in DNS moves to a list of retired selectors, and we go on checking it. You cannot add a selector by hand.

Finding no key at all is a note, not a problem: a sending service may sign your mail with its own domain, and then there is nothing to find at yours.

Change history

Each time a check finds a record whose value differs from before, the change history gets a new entry. A check that finds the same value adds nothing. The history covers the names under your domain, not the records of the services your SPF record includes. It keeps 13 months of changes on every plan.

A change to a record we had seen before raises an alert that the record changed. A change of DMARC policy raises an alert that the policy changed instead.

Every finding

Published 27 October 2026 · Checked 27 October 2026