Reading your report
A report starts with a status word and a one-line verdict, then answers three questions, then lists what to fix.
Status words
| Status | Means |
|---|---|
| Healthy | Nothing important is wrong. |
| Needs attention | Something important should be fixed soon. |
| At risk | Something critical is wrong now: mail may not arrive, or anyone can fake it. |
| Not checked yet | We haven't finished a check. |
Select Why? beside the verdict to see what it's based on.
Readiness levels
Readiness says how far your domain has come, one level at a time:
- Deliverable: your mail gets through. The basics receivers check are in place.
- Protected: receivers refuse mail that pretends to be you, because DMARC is enforced and every sender is set up.
- Hardened: protected, plus encrypted delivery (MTA-STS), signed DNS (DNSSEC) and a locked registration, plus a few tidy-ups such as TLS-RPT reports and strict DKIM alignment.
The readiness card lists the steps to the next level, each with a rough effort: Minutes, An afternoon, or Needs the vendor (something only your provider can do).
Severity
Each finding has a severity:
- Critical: fix it now.
- Important: fix it soon.
- Advisory: worth doing.
- Info: something you can do, like showing your logo.
Confidence
We tell you how sure we are:
- Certain: we read it directly from your records.
- Likely: we inferred it, for example by naming a service from a key name alone.
- Possible: a weak sign, worth a look.
Select any line in the three question cards to see why it matters and where the rule comes from. Select How to fix it to jump to the steps, including the exact records to publish.
In healthcheck.email
The domain's Overview tab holds the report. History lists past checks, and you can compare any check with the one before it.