See what a report tells you
See how we explain domain-check findings and report on ongoing services.
Free domain check: five public DNS findings
The free checker uses public DNS to review MX, SPF, DKIM, DMARC and Autodiscover. Results and the PDF download are free, with no signup or business details required.
It does not inspect Microsoft 365 tenant settings, MFA, mailbox activity, devices, websites or servers. It does not verify active DKIM signing or inherited DMARC policies. A pass is not a guarantee of security.
MX
ReviewMail routing needs context
A third-party mail gateway may sit in front of Microsoft 365. That can be intentional, rather than a fault.
Next step: Confirm the intended mail route with your email provider before changing records.
SPF
PassMicrosoft's sending service is listed
The SPF record includes Microsoft's sending service. This is a limited record check, not proof that every sender is authorised correctly.
Next step: Confirm other business sending systems are documented and included where needed.
DKIM
ReviewSigning records need confirmation
Published selector records can indicate a DKIM setup, but public DNS cannot confirm that outgoing messages are actively signed.
Next step: Ask your Microsoft 365 administrator to verify the tenant settings and a signed test message.
DMARC
FixNo domain-local DMARC policy was found
No domain-local DMARC record was found. The checker does not evaluate inherited policies, so this is not proof that the domain has no DMARC protection.
Next step: Ask your provider to check whether a parent-domain policy applies, confirm legitimate senders and publish an appropriate policy.
Autodiscover
UnavailableThe lookup did not return a usable answer
An unavailable lookup is not a confirmed configuration problem. A temporary DNS issue can prevent a result.
Next step: Retry the check, then ask your provider to review the record if it remains unavailable.
How to read the statuses
Pass: the record meets the check's limited criteria. Fix: a specific record issue needs attention. Review: the setup needs context from your provider. Unavailable: the checker could not establish a result; it is not a confirmed failure.
Reporting on agreed services
We agree what reporting covers, what work it records and how often we share it. Your reports bring together coverage, completed work and outstanding actions.
- Report period and freshness
- State the period covered and when each source was last checked. Mark missing or older information rather than presenting it as current.
- Covered areas
- List the services, accounts, devices, websites or domains actually in scope. Record exclusions and coverage gaps.
- Completed work
- Summarise agreed maintenance, configuration changes, support work and reviewed alerts, with dates and relevant evidence.
- Open actions
- Explain the issue, its business impact, who needs to act and any approval or help needed from another provider.
The free domain check reviews public email settings. Ongoing service reports cover the work and systems we manage for you.
