Email domain health check

Problems this finds

Your mailbox settings point to an address that doesn't exist

Senders trying to reach you can't connect to that address. Emails to you may be delayed, or, if there's no working backup, not arrive at all.

Your mailbox settings point to an address outsiders can't reach

One of your mailbox settings points to an internal network address, so senders outside your office can't deliver there. Whoever manages your mail server will need to supply the correct public address.

Some emails sent to you may not arrive

Your mailbox settings point to a shortcut name instead of the real address. Many senders follow it, but some refuse, so a few customers' emails may never reach you and you won't know.

One service on your list of approved senders didn't respond

When we checked, one service on your list gave no answer. It may be a temporary glitch, but if it stays broken, emails sent through that service may not be treated as approved.

Optional: show your logo next to your emails

Some inboxes can show your logo beside your emails. It doesn't affect delivery. It requires blocking fake emails first, and some inboxes, including Gmail, also require a paid certificate.

Your logo setting has a typo, so your logo isn't shown

Inboxes can't read the setting, so they ignore it. It doesn't affect whether your emails are delivered, only whether your logo appears.

Your logo won't show until fake emails are blocked

Inboxes only show your logo once your instructions for fake emails tell receivers to block them. Switch that on only after confirming your own emails pass, or real ones could be blocked.

Your email's digital seal has been switched off

The seal was deliberately withdrawn, which is normal when replacing it. But if your emails still use it, they fail the check and are more likely to land in spam or be rejected.

Your email's digital seal could be upgraded to a stronger one

It works today and receivers accept it. Stronger seals are now the standard, so switching the next time you're making changes is a small, sensible upgrade.

Your email's digital seal is too weak to trust

It uses an outdated, short code that can be cracked, which would let scammers make fake emails look sealed by you. Some receivers already refuse it. Your email provider can issue a stronger one.

Your email's digital seal is damaged and can't be read

The setting was likely cut short or had spaces added when it was pasted. Every email sealed with it fails the check, and nothing warns you because your provider thinks it's working.

Your email's digital seal is still marked as a test

Receivers are told they may ignore failures of your seal, which weakens the protection it gives. If your seal is working, removing the test marker is a quick change.

Your instructions for fake emails only cover some of them

Receivers apply your instructions to only a share of fake emails. That's normal while testing. Once you're confident, covering all of them finishes the job.

Fake emails pretending to be you are still delivered

Your instructions for fake emails are set to watch only. That's the right first step, but fakes in your name still get through. Once your real emails are confirmed to pass, you can tell receivers to block fakes.

Your instructions for fake emails have a typo

Receivers can't read them, so they may throw them out entirely. Fake emails in your name then aren't blocked, even though your settings look like they should be.

You're not getting reports on who sends email as you

Without reports you can't see which services send in your name, or know when it's safe to start blocking fakes. Adding an address for reports doesn't change how your email is delivered.

Your instructions for fake emails use the standard matching setting

Emails from variations of your address, like news.yourbusiness.com, count as yours. This is the default and suits most businesses. Nothing to do.

This domain is set to not receive email

Your settings clearly tell senders this domain doesn't accept email, so they get an immediate, clean bounce. That's correct if you don't use it for email; if you do, it needs changing.

Your reports are going somewhere that hasn't agreed to accept them

Your reports are addressed to another domain that hasn't confirmed it accepts them, so receivers quietly don't send them. The fix is made on that other domain; if it's a reporting service, ask them.

An old, unused copy of your approved senders list is still there

Receivers ignore it, so it doesn't affect your email today. Removing it is a small tidy-up that avoids confusion the next time someone edits your domain's settings.

Your instructions for fake emails are being ignored

You have two sets of instructions where only one is allowed, so receivers ignore both. Any protection you set up is effectively switched off, and your reports stop arriving.

You have two lists of approved senders, which cancels both out

Only one list is allowed. With two, receivers ignore both, so every email you send fails this check and is more likely to land in spam or be rejected.

Optional: add encrypted delivery protection for emails sent to you

Emails to you are usually encrypted on the way, but this makes it required, so an attacker can't quietly switch encryption off and read them. Setting it up needs help from whoever runs your website.

Some emails to you could be refused because of a settings mismatch

Your encrypted delivery protection doesn't list every server that receives your email. When it's fully on, senders refuse to deliver to the missing one. Whoever set it up needs to add it.

Your encrypted delivery protection is still in test mode

Problems are reported but nothing is blocked yet, so the protection isn't active. Once the reports show no problems, whoever set it up can switch it fully on.

Your encrypted delivery protection is switched on but not working

Your settings announce this protection, but the file it depends on can't be reached, so senders ignore it. Your email still arrives. Whoever runs your website will need to fix the file.

We couldn't find your email's digital seal where we usually look

It may be set up under a name we can't see, which is common. If it truly is missing, forwarded emails are more likely to fail checks. Your email provider can tell you which is the case.

We found no digital seal under the name you gave us

Emails sealed under this name can't be verified, so they fail this check and are more likely to land in spam. The setting may be missing, misspelled, or replaced by your provider.

Nothing tells receivers to block fake emails pretending to be you

Without instructions for fake emails, scammers can email your customers in your name with nothing from you standing in the way, and you get no reports showing who is sending as you.

Your business can't receive email at this domain

There are no mailbox settings, so emails sent to you, like customer inquiries and replies to your quotes, bounce back. If you don't use this domain for email, you can say so instead.

You have no list of approved senders

Receivers can't check that your emails come from services you actually use, so invoices and replies are more likely to be treated with suspicion. Gmail, Yahoo and Outlook expect businesses to have one.

Your business receives email through one server with no backup

If that server has an outage, emails to you are delayed, and lost if it lasts for days. Many providers use just one on purpose, so check your provider's instructions before changing anything.

Your list of approved senders has a typo in it

Part of the list isn't written correctly. Some receivers ignore the whole list when that happens, so the same email can pass at one company and fail at another.

Your list of approved senders points to services that no longer exist

These dead entries use up space on your list. If there are more than two, receivers treat the whole list as broken for every email you send.

Your list of approved senders doesn't turn anyone away

It says who may send as you but takes no position on everyone else, so receivers treat it much like having no list. A one-word change at the end makes it count.

Your settings approve anyone in the world to send email as you

Your list of approved senders ends with a setting that approves every server on the internet. Scammers can send email in your name and it will pass this check. That is worse than having no list at all.

Your list of approved senders is over its limit

Receivers stop reading a list that points to too many services, and then treat the whole list as broken. That affects every email you send, not just the ones from the last services listed.

Some services on your list of approved senders are being ignored

A service was added after the list's closing entry, and receivers stop reading there. Emails sent through that service aren't approved and may land in spam or be rejected.

Your list of approved senders doesn't say what to do with everyone else

It names who may send as you but never says that others may not, which weakens the protection it's meant to give. Adding a short ending to the list fixes it.

Your list of approved senders is close to its limit

Nothing is broken today, but a change made by one of the services you use could push it over and break the list for every email you send. Removing services you no longer use gives you room.

Your list of approved senders uses an outdated method

One entry uses an old, slow method that some receivers skip. Replacing it is a minor clean-up that makes your list more reliable and frees up room under its limit.

Fakes from addresses like billing.yourbusiness.com aren't blocked

Your main address is protected, but variations of it have weaker instructions. Scammers can invent one (it doesn't need to exist) and use it to send fake emails in your name.

Optional: get reports about encrypted delivery to your inbox

These daily reports show when emails to you failed to arrive encrypted. They matter most before switching on encrypted delivery protection, so that it doesn't block real email.

Your reports about encrypted delivery have a typo, so none are sent

The setting can't be read, so no reports arrive even though it looks like they should. Problems with encrypted delivery to you can go unnoticed.