How do I read the domain health card?
The domain health card checks the DNS records and blocklists that decide whether mailbox providers trust mail from your domain. Open it from Accounts, click a mailbox, then open the Health tab. Each check shows one of four states, and the card's headline is the worst of them.
The four states
| State | Meaning |
|---|---|
| Pass | Checked and fine |
| Warn | Works, but there is something worth tightening. Not a failure |
| Fail | Something is missing or broken and it will hurt delivery |
| Unknown | Warmerly could not get an answer this time. This is not a pass and not a fail |
Unknown is never shown as green. If a DNS server was slow or a blocklist refused the query, the check says so and tries again automatically. Do not change your DNS because of an unknown result.
What is checked
SPF
Which servers may send as your domain. The card flags:
- No SPF record (fail).
- More than one SPF record, or a record with an unreadable part (fail). Providers ignore a broken SPF record completely.
- SPF authorises the entire internet (fail), meaning a record ending in
+all. - Too many DNS lookups (fail when over the limit of 10, warn when close to it).
- No ending rule, or an ending that takes no position on unknown senders (warn).
- Soft fail (
~all) is shown as information only and does not lower the state.
DKIM
Whether your mail is signed. The card flags No DKIM signature found (fail), DKIM is still in test mode (warn) and a short key (warn).
Warmerly finds DKIM by trying a list of common selector names. If your provider uses an unusual one, the card can say "none" for a domain that is signed. Enter your selector under Settings, DKIM selector and re-check. See Setting up DKIM and Troubleshooting.
DMARC
The policy telling receivers what to do with forged mail. The card flags No DMARC record
(fail), DMARC is monitor-only (warn, and very common, since p=none is the normal
starting point) and a record with no policy (warn). Applying to only part of your mail, or not
collecting reports, are shown as information. See SPF & DMARC.
MX
Whether your domain can receive mail. No MX records is a fail: a domain that cannot receive replies looks suspicious, and warmup needs replies.
Blocklists
Your domain and your mail server's IP address are checked against public spam blocklists. Warmerly checks six domain lists and ten IP lists. See What if my domain or IP is on a blocklist? for how to read a listing and get removed.
Blocklist results can be:
- Clean on all N lists: pass.
- Clean on some lists, others did not answer: warn, and the card says how many did not answer. It is honest that the picture is incomplete.
- Your domain is blocklisted or Your mail server's IP is blocklisted: fail.
- This IP range isn't meant for sending: warn. This is a statement about the IP range (typically a home or office connection), not a spam report against you.
- Blocklist status unknown: unknown.
"Your mail server's IP" is not always yours
The IP check looks up the mail server your mailbox submits mail to. For a small or self-hosted mail server, that is the address your mail leaves from. For large providers such as Gmail or Microsoft 365, your mail leaves from a different pool, so Warmerly skips the IP check for them and says so, rather than reporting on an address you cannot control.
Gmail, Outlook and other shared domains
If your mailbox address is on gmail.com, outlook.com or a similar consumer domain, the DNS records belong to the provider. The card shows a headline like "You're all set, gmail.com is managed by Gmail" instead of grading records you cannot change, and the domain itself is not checked against blocklists.
Re-checking
Click Re-check now after you change a DNS record. DNS records are re-read immediately. Blocklists are checked at most about every six hours, so a re-check may reuse a recent blocklist result. DNS records are also re-checked automatically in the background, and blocklists about every six hours. DNS changes can take time to spread, so give a new record some minutes before concluding it has not worked.
Alerts
Warmerly emails an alert when a hard failure appears in your records (a fail, not a warn), or when your domain or IP is newly blocklisted. Warnings such as DMARC monitor-only never trigger an alert.
Common problems
Everything is unknown on a new mailbox. The first checks run shortly after you connect. Wait a few minutes and use Re-check now.
A record shows fail but I just added it. DNS has not spread yet, or the record was added under the wrong name. Compare it against Email DNS records: the complete checklist.
DMARC shows warn and I have a record. Almost always p=none. It is safe to leave while you
are starting out.
Related
- Email DNS records: the complete checklist
- Deliverability checklist before you launch
- Free deliverability tools to check any domain without an account