How Domain Email Doctor works

The scan only reads public DNS records - it does not log in to your mail provider, change DNS, or ask for your email password. If you choose the optional auto-fix, it changes DNS only on a supported host, only with a scoped API token you create, and only the exact records you approve.

1. Resolve public DNS

The scanner queries DNS-over-HTTPS for NS, MX, TXT, CNAME, A, and AAAA records using public resolvers.

2. Detect providers

Deterministic patterns identify common DNS hosts, website hosts, and email providers without treating website hosting as mail hosting.

3. Explain safe next steps

The rule engine checks MX, SPF, SPF lookup count, DKIM selectors, and DMARC policy, then explains what to add, update, or review. When a fix is deterministic, it shows concrete records. When a provider-generated value is required, it tells you what to copy from your email provider instead of inventing it.

DKIM note: DKIM selector names are provider-specific. Common-selector checks help, but a missing common selector is not proof DKIM is absent. Domain Email Doctor does not invent DKIM keys, verification tokens, or tenant-specific provider values.

Run an email DNS check