healthcheck.email Sign in

Known quirks

How email services really behave, so a report explains what can't or needn't be fixed instead of flagging it.

HubSpot

HubSpot's SPF may not line up with your domain We didn't find a custom return path for HubSpot, so its SPF won't line up with your domain. That's normal for HubSpot. Your mail is still authenticated, because HubSpot signs it with your own DKIM key.

Amazon SES

Amazon SES's SPF may not line up with your domain We didn't find a custom MAIL FROM domain for SES, so its SPF won't line up with your domain. That's normal for SES. Your mail is still authenticated, because SES signs it with your DKIM key.

Postmark

Postmark's SPF may not line up with your domain We didn't find a custom return path for Postmark, so its SPF won't line up with your domain. That's normal for Postmark. Your mail is still authenticated, because Postmark signs it with your DKIM key.

Mandrill

Mandrill's SPF may not line up with your domain We didn't find a custom return path for Mandrill, so its SPF won't line up with your domain. That's normal for Mandrill. Your mail is still authenticated, because Mandrill signs it with your DKIM key.

Microsoft 365

Microsoft 365 doesn't sign with your domain until you turn DKIM on Microsoft 365 signs mail with its own onmicrosoft.com domain by default. For DMARC, mail has to be signed with your domain, and that's a switch you turn on.

Every domain

Forwarded mail can fail SPF, so DMARC rests on DKIM When someone forwards your email, or a mailing list resends it, SPF usually fails along the way. That's normal. DKIM is what keeps it passing, so every service that sends as you should sign with DKIM.