DNS and email protection

These checks read your domain's DNS records:

• spf_missing / spf_permissive: no SPF record, or one that lets anyone send mail as your domain (+all). Add the SPF line your mail provider publishes.
• dmarc_missing / dmarc_none: no DMARC record, or one that only observes (p=none). Start with p=none and a report address, then move to quarantine once reports show only legitimate senders.
• dkim_missing: no DKIM key found at common selectors. Your mail provider gives you the record; some use their own selector names, so this can be a false alarm.
• caa_missing: no CAA record limiting which certificate authorities may issue for your domain.
• blacklisted / blacklisted_shared: a mail server address is on a spam blocklist (shared addresses of big providers are reported separately).
• domain_expiring, domain_expired, no_transfer_lock: registration dates and the transfer lock from the registry.

DNS changes can take a while to be visible everywhere; scan again later to verify the fix.