What does the domain health check look at?

The five DNS records that decide whether mail from a domain is trusted: SPF (which servers may send), DKIM (the signing key), DMARC (what receivers do with mail that fails), MX (where replies and bounces go) and BIMI (the logo some inboxes show). Each gets a verdict and, when something is wrong, the change that fixes it.

Does it check Gmail and Yahoo's sender requirements?

It checks the parts DNS can show: SPF or DKIM for every sender, and SPF, DKIM and a DMARC record for bulk senders. Alignment of the From domain, one-click unsubscribe and the spam-complaint rate are properties of the messages you send, so the result says so rather than guessing.

Why does it say no DKIM key was found when I have one?

DNS cannot list a domain's DKIM selectors, so without one the check tries the selectors the large providers use. Find s= in the DKIM-Signature header of a message the domain sent and enter that selector to check your real key.

Is the result cached?

No. Every check reads live DNS through our server's resolver, so a record you have just published shows up as soon as its old value expires from DNS caches.

Free tool

Email domain health check

Check a domain's SPF, DKIM, DMARC, MX and BIMI records in one go, see what Gmail and Yahoo require, and get the exact fix for each problem.

Last updated 2026-10-21

Run it with curl

This tool is also a free API: no account, no key, CORS open. OpenAPI description.

curl "https://sendly.now/api/tools/domain-health?domain=example.com&selector=google"

# Markdown instead of JSON:
curl -H "Accept: text/markdown" "https://sendly.now/api/tools/domain-health?domain=example.com&selector=google"

What the check reads

SPF: whether the record parses, how strict its all is, and how many of the 10 allowed DNS lookups its includes spend.
DKIM: the public key at the selectors you name, or at the selectors the large providers use, with its size and flags.
DMARC: the policy that applies to the domain (its own, or the organizational domain's), its coverage and where reports go.
MX: where mail to the domain is delivered, whether each server resolves, and which provider runs them.
BIMI: whether a logo can show, which depends on DMARC enforcement and, for Gmail, a mark certificate.

Reading the verdict

At risk means at least one record can send mail to spam or lets others send as the domain: a missing or broken SPF record, no DMARC record, or mail servers that do not resolve. Needs attention means mail is delivered but a setting is weaker than it should be, such as DMARC at p=none. Each finding names the record to change and what to change it to.

Questions people ask

What does the domain health check look at?: The five DNS records that decide whether mail from a domain is trusted: SPF (which servers may send), DKIM (the signing key), DMARC (what receivers do with mail that fails), MX (where replies and bounces go) and BIMI (the logo some inboxes show). Each gets a verdict and, when something is wrong, the change that fixes it.
Does it check Gmail and Yahoo's sender requirements?: It checks the parts DNS can show: SPF or DKIM for every sender, and SPF, DKIM and a DMARC record for bulk senders. Alignment of the From domain, one-click unsubscribe and the spam-complaint rate are properties of the messages you send, so the result says so rather than guessing.
Why does it say no DKIM key was found when I have one?: DNS cannot list a domain's DKIM selectors, so without one the check tries the selectors the large providers use. Find s= in the DKIM-Signature header of a message the domain sent and enter that selector to check your real key.
Is the result cached?: No. Every check reads live DNS through our server's resolver, so a record you have just published shows up as soon as its old value expires from DNS caches.

Something on this page out of date, or missing the case you are in? Write to support@sendly.now — we answer our own email. The full technical detail lives in the documentation.