About Domain Email Doctor
Domain Email Doctor is a public email DNS checker for domains that need clearer MX, SPF, DKIM, and DMARC diagnostics. The goal is simple: enter an email address or domain, get a clear report, then follow safe next steps without guessing DNS records.
What we check
We only inspect public DNS records. The scanner checks receiving mail records, SPF sending authorization, DKIM selector signals, DMARC policy, DNS host signals, website host signals, and provider consistency clues.
What we do not do
We never ask for passwords or provider logins. The scan only reads public DNS and changes nothing. The optional auto-fix applies only eligible exact DNS changes that you individually approve, and it never deletes anything. Credentials are supplied per request and never stored. Credential access differs by host: Cloudflare: select only this zone and grant both Zone DNS Edit and Zone Read. DNS Edit can create, change, or delete records in the zone, although this connector never deletes records. Porkbun: restrict the key's exact target-domain allowlist to this domain and enable API Access on the domain. The key is still not DNS-only and can perform other Porkbun API operations for the allowed domain; this connector never deletes records. DigitalOcean: create a custom-scoped token with domain:read, domain:create, and domain:update. Those actions cover every managed domain in the team, but not deletion or non-domain resources. Vercel: this is not a DNS-only token; it grants broad API access within the selected Personal Account or Team, subject to your Vercel role. This connector omits the teamId Vercel requires for Team resources, so use Personal Account scope here. deSEC: use a default-deny RRset policy that permits writes only for this domain, with domain create/delete and token-management disabled. All deSEC tokens can still read every RRset across every domain in the account. AWS Route 53: create a dedicated IAM user, never root or admin. Attach the explicit two-statement policy shown in setup: discovery on Resource '*', then record reads and UPSERT-only writes on arn:aws:route53:::hostedzone/<ZONE_ID>. Replace <ZONE_ID> with the target hosted-zone ID; never broaden that ARN to '*'. Keep writes restricted to MX, TXT, and CNAME. We do not access inboxes, send test email, guarantee inbox placement, or promise that a domain reputation problem is fixed.
Why the flow is one input
The product is designed for people who are unsure where email DNS is broken. The scanner asks for only an email address or domain first, then asks follow-up questions only when a result needs extra context.