One check for email authentication (SPF, DMARC, DKIM, MX), DNS health and registration details (expiry, lock), with the issues to fix first.
The Domain Overview Check combines a domain's email authentication setup, DNS health and registration details in one report, with a score out of 100 and the issues to fix first. Free, no sign-up.
It reads SPF, DMARC, DKIM and MX for email; nameserver redundancy and answers, DNSSEC and CAA for DNS; and expiry and domain lock (transfer lock) for registration — from public DNS, the nameservers themselves and RDAP / JPRS WHOIS. Slower investigations such as subdomain takeover and lookalike domains can be run from the results, only when you need them.
| Category | Weight | What is checked |
|---|---|---|
| Email authentication | 60% | DMARC policy (reject / quarantine / none), SPF 10-lookup limit and trailing all, DKIM, MX, aggregate reports (rua) |
| DNS | 25% | Nameserver redundancy and answers (lame delegation, …), SOA serial and parent delegation agreement, DNSSEC validation, MX resolution. CAA, IPv6 and missing DNSSEC are shown for information and not scored |
| Registration | 15% | Expiry (critical within 30 days, warning within 90) and domain lock (transfer lock) |
Any critical problem caps the overall score at 69 (C). Anything that could not be measured (for example registration data for TLDs without RDAP / WHOIS such as .io, .de, .cn) is left out and the rest is scored.
| Grade | Score | Meaning |
|---|---|---|
| A | 90–100 | Very good. The basics are in place. |
| B | 75–89 | Mostly good, with minor improvements to make. |
| C | 60–74 | Room for improvement. |
| D | 40–59 | Needs action: spoofing is still possible. |
| E | 0–39 | Urgent attention needed. |
Limitations
• A one-time snapshot of public DNS. DKIM probes common selectors only, so "not found" does not prove DKIM is missing.
• The score is a prioritisation aid, not a guarantee of security.
• For a subdomain, email authentication is evaluated for that subdomain (DMARC inherited from the organization domain) and registration for its registrable domain.
What should I do first to raise the score?
Work through "Fix these first" from the top. Usually publishing DMARC (starting at p=none) and tidying SPF come first. The guide explains how to move to p=reject safely.
My DMARC policy is p=none. What does that score?
p=none only monitors and does not reject spoofed mail, so email authentication is rated "monitoring only" (around 55). Raise it step by step to p=quarantine and p=reject while reviewing reports.
Registration details are missing.
TLDs without RDAP (e.g. .io, .de, .cn) or a temporary lookup failure show nothing; the score then uses email authentication only.
Is it OK to check someone else's domain?
The tool only reads public information (public DNS and RDAP / WHOIS). Still, abusing the results is prohibited.