DNS Doctor FAQ

The free scan diagnoses SPF, DKIM, DMARC, MX, DNS, blacklist status and domain/SSL expiry in one pass, and gives you the exact record to paste in to fix each problem. Monitoring is the paid follow-up care: it re-scans your domains every day, ingests your DMARC aggregate reports, watches for lookalike domains registered close to yours, and alerts you when a record drifts, a certificate or domain nears expiry, or authentication starts failing, before it breaks delivery.

Never. DNS Doctor only reads your DNS and generates the record you should publish. You copy and publish every record yourself; we have no write access to your DNS. The tool diagnoses and drafts the fix; you stay in control of the change.

Monitor is one flat plan: $12 a month, or $120 a year (2 months free). It covers up to 10 domains with unlimited scans, 12 months of report retention, all alerts and a daily lookalike-domain watch. If you only need one domain moved to enforcement, DMARC enforcement, done with you covers it for up to 90 days for $99, paid once: each step backed by your own reports, with everything Monitor does for that domain except the lookalike watch. Every account starts with a 14-day trial that needs no card — you only enter payment details if you decide to stay. The trial shows when your domain is ready for p=reject; the p=reject step itself ships with the package or Monitor.

It never recommends a stronger policy without evidence. Enforcement readiness looks at your DMARC aggregate reports over a trailing 30-day window and only unlocks the next step — from p=none toward quarantine, then reject — when every known sending source is at least 99% aligned and the UNALIGNED volume from unknown sources stays below half a percent. An empty window is never treated as ready, and the last rung asks for one thing more: at least three separate days of authenticated reporting, because reject turns mail away outright. The record it proposes is generated deterministically, so it can't recommend reject on a guess.

No — only reports we can attribute. The rua= address in a DMARC record is public, so anyone can mail a report to it, and a report claiming perfect alignment would otherwise push a domain toward reject. DNS Doctor authenticates each report's own message (DKIM, or SPF on the sending server) and counts it toward readiness only when it comes from a mailbox provider or reporting service on our verified list, or when you uploaded it yourself. Everything else is still stored and shown on the dashboard, labelled as unverified, and moves no verdict.

From DMARC aggregate (RUA) reports. When you enroll a domain, DNS Doctor gives you a rua= address to add to your DMARC record; the mailbox providers that support DMARC reporting send daily aggregate reports there, which we parse into per-source statistics. You can also upload reports you already have to backfill the history instantly. Reports and their per-source data are retained for 12 months.

In one click from your billing settings, which open the Paddle customer portal. Paddle is our merchant of record and handles the subscription; cancelling stops future charges, and your data stays visible for the rest of the period you've paid for.

We query a set of reputable DNS blacklists through our own dedicated resolver, with a strict whitelist of listing codes so an ambiguous answer is reported as 'not checked' rather than a false positive. Spamhaus is deliberately not queried: a free public scanner counts as commercial, high-volume use under its terms, and querying it through a public resolver returns a code that means 'you are blocked', not that your domain is listed — misreading that would emit a false alarm. So the report carries an honest 'not checked' line for Spamhaus instead.

Email support@dnsdoctor.dev. We read every message, and a real person — not a bot — answers deliverability questions and account issues.