How Domain Email Doctor works
The scan only reads public DNS records. It does not log in to your mail provider, change DNS, or ask for your email password.
If you choose the optional auto-fix, it changes DNS only on a supported host and only for eligible exact changes you individually approve. Credentials are supplied per request and never stored.
1. Resolve public DNS
The scanner queries DNS-over-HTTPS for NS, MX, TXT, CNAME, A, and AAAA records using public resolvers.
2. Detect providers
Deterministic patterns identify common DNS hosts, website hosts, and email providers without treating website hosting as mail hosting.
3. Explain safe next steps
The rule engine checks MX, SPF, SPF lookup count, DKIM selectors, and DMARC policy, then explains what to add, update, or review. When a fix is deterministic, it shows concrete records. When a provider-generated value is required, it tells you what to copy from your email provider instead of inventing it.
Credential access by provider
These details apply only if you choose an optional auto-fix connector. Credential access differs by host:
Cloudflare
Cloudflare: select only this zone and grant both Zone DNS Edit and Zone Read. DNS Edit can create, change, or delete records in the zone, although this connector never deletes records.
Porkbun
Porkbun: restrict the key's exact target-domain allowlist to this domain and enable API Access on the domain. The key is still not DNS-only and can perform other Porkbun API operations for the allowed domain; this connector never deletes records.
DigitalOcean
DigitalOcean: create a custom-scoped token with domain:read, domain:create, and domain:update. Those actions cover every managed domain in the team, but not deletion or non-domain resources.
Vercel
Vercel: this is not a DNS-only token; it grants broad API access within the selected Personal Account or Team, subject to your Vercel role. This connector omits the teamId Vercel requires for Team resources, so use Personal Account scope here.
deSEC
deSEC: use a default-deny RRset policy that permits writes only for this domain, with domain create/delete and token-management disabled. All deSEC tokens can still read every RRset across every domain in the account.
AWS Route 53
AWS Route 53: create a dedicated IAM user, never root or admin. Attach the explicit two-statement policy shown in setup: discovery on Resource '*', then record reads and UPSERT-only writes on arn:aws:route53:::hostedzone/<ZONE_ID>. Replace <ZONE_ID> with the target hosted-zone ID; never broaden that ARN to '*'. Keep writes restricted to MX, TXT, and CNAME.