Will your domain still work next month?
Some failures do not warn you first. A registration lapses and the site, the email and every ranking go with it. A missing SPF or DMARC record does not stop your mail being sent, it just means more of it is filed as spam, so order confirmations stop arriving while everything still looks fine.
Reads the public registration record and the public DNS records. Nothing is stored.
How this check works
Shipwork reads the registration expiry from the registry record, then resolves the SPF, DMARC and MX records the way a receiving mail server does. It reports the renewal date, whether one SPF record is published and how strict it is, whether DMARC is present and enforcing, and whether the domain can receive a reply at all.
What the domain and email safety check inspects
The domain and email safety check looks at three things that fail in DNS and at the registrar rather than on a page. It reads the registration record to find the expiry date, checks the domain's mail records for SPF and DMARC, and checks whether the domain has a mail exchanger. It reduces the host to its registrable domain first, so a subdomain is checked against the right apex.
The SPF and DMARC verdicts come from the same rules used by the paid email check, so the two cannot disagree. Each piece is only judged when its lookup actually returns an answer, so a failed lookup does not produce a false claim that a record is missing.
How to read a domain safety result
For registration, an error means the domain has already expired, a warning means it expires within 45 days, and a clean result gives the date and the days remaining. For SPF, a missing record is a warning, more than one record is an error because receivers may ignore all of them, a strict ending is the good case, a soft-fail ending is acceptable, and an ending that asserts nothing is worth a warning.
For DMARC, a missing record is a warning, a record with no policy is a warning, and a monitoring-only policy is reported as information rather than a fault. A domain with no mail exchanger is noted as information because it cannot receive replies. The check cannot inspect the certificate your site actually serves, so it does not claim to.
Common causes and why they matter
Domain expiry is easy to forget because it is annual and automatic until the card or the reminder fails. A lapsed registration takes the site, the email and every ranking with it, and the name can be registered by anyone the moment it drops. Mail records are usually absent because mail worked without them, so nothing forced the issue.
Without an SPF record, receivers cannot tell your order confirmations from forged mail, so more of your mail is filed as spam. Without DMARC, you get no reports and no policy for what to do with mail that fails. These failures are silent and only surface as missing email, by which point customers are already affected.
How to fix domain and email records
Turn on automatic renewal for the registration and keep the payment method current, so the expiry warning is a backstop rather than the plan. For SPF, publish exactly one record at the apex ending in a strict all clause, and delete any duplicate. For DMARC, publish a record with a policy, start at monitoring to collect reports, then move to quarantine or reject once you know every legitimate sender passes.
If the domain is meant to receive mail, make sure it has a mail exchanger, and confirm a reply reaches the published address. Make these changes in your DNS provider and allow time for records to propagate. Re-run the check afterwards and confirm each item reads as expected, especially that only one SPF record remains.
When to use related checks
Use email security for the fuller mail-authentication picture, including related records. Use DNS check to inspect what the domain resolves to, and TLS certificate for the certificate your site serves.
The registrar and DNS layer is easy to ignore because it usually works, but failures there are the most damaging when they arrive. Checking expiry and mail records on a schedule, rather than when something breaks, is the point of this check.
Questions
Why does the expiry date matter?
What does an SPF record do?
Is p=none good enough?
How do I check when my domain expires?
Is p=none good enough for DMARC?
Why does my domain need MX records?
Does the domain check test my TLS certificate?
Keep reading
What this reads
- Reads public pages from outside your network, the way a crawler does.
- No signup, and nothing is stored on the free checks.
- One of 83 checks across discovery, content, markup, trust and catalogue data.
Cool, just ran an audit and got some insights! Let’s see if I can fix them :)
Whoah! this site is crazy, nothing to roast at all
cool as heck, tried it on my blog and the insights it gave are helpful and not bluff.