# DNS Doctor

> Scan, fix and verify your domain's DNS: email authentication (SPF, DMARC, DKIM), global propagation, MX, DNS health, blacklists and domain/SSL expiry — in plain English, with the exact copy-paste record to fix each problem. A deterministic engine generates and validates every authoritative DNS record; the AI layer only writes the human explanation, never the record string.

The free scanner is at the home page. Per-domain report pages live at `/scan/<domain>` (e.g. `https://dnsdoctor.dev/scan/example.com`) — server-rendered, one page per scanned domain. Paid monitoring (DMARC RUA ingestion, enforcement-readiness, alerts, a daily lookalike-domain watch with threat scores, multi-domain) is the upsell.

Pricing: the scanner and every tool below are free, no signup or card. Monitor (the paid tier) is $12/month — or $10/month billed annually — for 10 domains, with a 14-day trial, no card required. Or $99 once for "DMARC enforcement, done with you": one domain for up to 90 days, each step toward reject backed by its own DMARC reports, the exact record for each stage and Monitor included for the period, with no promised end policy (the lookalike watch stays with Monitor). The trial shows when your domain is ready for p=reject; the p=reject step itself ships with the package or Monitor. Details: https://dnsdoctor.dev/pricing

Building on top of this site? [https://dnsdoctor.dev/llms-full.txt](https://dnsdoctor.dev/llms-full.txt) adds the live HTTP API contract, the scan → fix → re-scan verification loop, and the monitoring hand-off — everything needed to use the scanner programmatically.

## Tools

Free deterministic diagnostics — the same engine the scanner uses, no signup:

- [SPF lookup counter](https://dnsdoctor.dev/tools/spf-lookup-counter): Count DNS lookups in an SPF record against the 10-lookup limit; nested includes counted recursively.
- [DMARC record checker](https://dnsdoctor.dev/tools/dmarc-checker): Validate every tag of a DMARC record with plain-English findings and a safely-capped upgrade preview.
- [DKIM checker](https://dnsdoctor.dev/tools/dkim-checker): Check any DKIM selector — the published record, key strength, and revocation status.
- [DMARC record generator](https://dnsdoctor.dev/tools/dmarc-generator): Generate a ready-to-publish DMARC record, RFC-validated in code — never an AI guess.
- [DMARC visualizer](https://dnsdoctor.dev/tools/dmarc-visualizer): Play back how a receiver evaluates a domain: the SPF include tree with its running 10-lookup ledger, the DMARC record tag by tag, the alignment gate, and the deterministic fix record.
- [DNS propagation checker](https://dnsdoctor.dev/tools/dns-propagation-checker): Read one DNS name from six vantage points on four continents at once — which already serve the new value, which still serve the old one.
- [DMARC report viewer](https://dnsdoctor.dev/tools/dmarc-report-viewer): Read a DMARC aggregate report (XML, .gz, .zip) as a table of sending sources; parsed on our servers, never stored.
- [Email test](https://dnsdoctor.dev/tools/email-test): Get a single-use address, send it one real email, and see how that message authenticated: envelope, SPF, every DKIM signature, DMARC alignment and blocklists, scored out of 10 with each deduction itemized.
- [DNS record checker](https://dnsdoctor.dev/tools/dns-record-checker): Read one record straight from the domain's own nameservers, cache-free, beside two public caching resolvers — an edit that is live vs one caches still hide, and how long those caches have left.
- [WHOIS lookup](https://dnsdoctor.dev/tools/whois): Read a domain's registration from the registry over RDAP — registrar, registration and expiry dates, EPP status codes, nameservers and DNSSEC. A registry that does not answer says so; it is never reported as the domain being free.
- [BIMI checker](https://dnsdoctor.dev/tools/bimi): Check a domain's BIMI logo readiness: the DMARC enforcement gate (naming each DMARC record read), the published BIMI record verbatim, the logo validated as SVG Tiny PS, the mark certificate parsed and chain-verified to a Mark Verifying Authority root (revocation not checked), and per-mailbox eligibility for Gmail, Apple Mail, Yahoo/AOL, Fastmail and Outlook. Eligibility, never a promise that a logo will show.
- [BIMI SVG converter](https://dnsdoctor.dev/tools/bimi-svg-converter): Convert a square SVG logo to SVG Tiny PS, the profile BIMI requires: deterministic, nothing stored, raster images never traced. A file that already passes comes back byte for byte.
- [Reverse DNS checker](https://dnsdoctor.dev/tools/reverse-dns-checker): Look up a mail server IP's reverse name and check it resolves back to the same address — the forward-confirmed test receivers actually apply.

## Guides

Email-DNS explainers and how-to guides. Index: [https://dnsdoctor.dev/learn](https://dnsdoctor.dev/learn)

### Foundations

- [What is SPF? A plain-English guide](https://dnsdoctor.dev/learn/what-is-spf): SPF lets a receiving mail server check the sending server is authorized by the envelope domain. The record syntax, the 10-lookup limit, and what SPF misses. (markdown twin: https://dnsdoctor.dev/learn/what-is-spf.md)
- [What is DKIM? Signatures, selectors, and keys](https://dnsdoctor.dev/learn/what-is-dkim): DKIM signs each email so receivers can verify it really came from your domain and was not altered. How selectors, key records, and rotation work. (markdown twin: https://dnsdoctor.dev/learn/what-is-dkim.md)
- [What is DMARC? Policy, alignment, and reports](https://dnsdoctor.dev/learn/what-is-dmarc): DMARC tells receivers what to do with mail that fails SPF and DKIM alignment. How alignment really works, what each policy does, and the safe path to reject. (markdown twin: https://dnsdoctor.dev/learn/what-is-dmarc.md)
- [Email deliverability: why your mail lands in spam](https://dnsdoctor.dev/learn/email-deliverability-basics): What receiving mail servers actually weigh — authentication, reputation, blacklists, PTR, content — what a domain owner controls, and the myths to skip. (markdown twin: https://dnsdoctor.dev/learn/email-deliverability-basics.md)
- [Why monitor DMARC reports? What the data tells you](https://dnsdoctor.dev/learn/why-dmarc-monitoring): DMARC aggregate reports list every server sending as your domain. Why the raw XML is unreadable, what monitoring extracts, and what enforcement-ready means. (markdown twin: https://dnsdoctor.dev/learn/why-dmarc-monitoring.md)
- [Who requires DMARC now? Google, Yahoo, Outlook and beyond](https://dnsdoctor.dev/learn/dmarc-requirements): Google and Yahoo require DMARC for bulk senders since February 2024, Outlook since May 2025. Who requires what, at what volume, and where adoption stands. (markdown twin: https://dnsdoctor.dev/learn/dmarc-requirements.md)
- [DMARC monitoring after p=reject — why you're not done](https://dnsdoctor.dev/learn/dmarc-monitoring-after-reject): Reaching p=reject is the milestone, not the finish line. Why DMARC reports still matter at enforcement: new senders, silent drift, and mail that vanishes. (markdown twin: https://dnsdoctor.dev/learn/dmarc-monitoring-after-reject.md)
- [DNS propagation: what's actually happening, and how long it takes](https://dnsdoctor.dev/learn/dns-propagation-explained): Why a DNS change shows up in one place and not another, why '24–48 hours' is a myth, what TTL really does, and how to verify a change has gone global. (markdown twin: https://dnsdoctor.dev/learn/dns-propagation-explained.md)

### How-to guides

- [How to add a TXT record to your DNS](https://dnsdoctor.dev/learn/how-to-add-a-txt-record): Add a TXT record at Cloudflare, GoDaddy, Namecheap, IONOS, OVHcloud, Route 53 and more, and find out which provider hosts your DNS. (markdown twin: https://dnsdoctor.dev/learn/how-to-add-a-txt-record.md)
- [Connect your domain to DNS Doctor monitoring](https://dnsdoctor.dev/learn/connect-your-domain): The full walkthrough: create an account, add a domain, prove ownership, publish the rua record, backfill old reports, and read your first diagnosis. (markdown twin: https://dnsdoctor.dev/learn/connect-your-domain.md)
- [DMARCbis (RFC 9989): what changed and what to do](https://dnsdoctor.dev/learn/dmarcbis-rfc-9989): DMARCbis (RFC 9989) is the standards-track update to DMARC. What changed from RFC 7489 — np, psd and t tags, pct deprecated — and what your domain needs to do. (markdown twin: https://dnsdoctor.dev/learn/dmarcbis-rfc-9989.md)
- [DNS Doctor MCP server — DMARC, SPF and DKIM tools for AI agents](https://dnsdoctor.dev/learn/dns-mcp-server): The DNS Doctor MCP server lets AI agents scan and fix DMARC, SPF, DKIM, MX, blacklists and expiry from Claude or any MCP client, hosted or via npm. (markdown twin: https://dnsdoctor.dev/learn/dns-mcp-server.md)
- [DNS skill for AI agents — DMARC, SPF and DKIM done safely](https://dnsdoctor.dev/learn/dns-skill): A DNS skill for Claude and other AI agents: the DMARC, SPF and DKIM workflow — scan, diagnose, fix with validated records — for Claude Code and OpenClaw. (markdown twin: https://dnsdoctor.dev/learn/dns-skill.md)
- [Pay per call: DNS Doctor's x402 burst lane for AI agents](https://dnsdoctor.dev/learn/x402-agent-payments): DNS Doctor's API now answers HTTP 402: past the free rate limit an agent can pay $0.01 in USDC on Base per call over the x402 protocol. (markdown twin: https://dnsdoctor.dev/learn/x402-agent-payments.md)
- [BIMI: how to get your logo next to your emails](https://dnsdoctor.dev/learn/bimi): What BIMI is, which inboxes show the logo and which need a certificate, the four steps in order, and why a valid record can still show no logo. (markdown twin: https://dnsdoctor.dev/learn/bimi.md)
- [Can you get your logo in Gmail without a VMC?](https://dnsdoctor.dev/learn/logo-in-gmail-without-vmc): Not as a logo for your whole domain. What works without a certificate: Yahoo, AOL, Fastmail, Apple Branded Mail and a Google Account photo per address. (markdown twin: https://dnsdoctor.dev/learn/logo-in-gmail-without-vmc.md)
- [How to get DMARC to p=reject without breaking email](https://dnsdoctor.dev/learn/dmarc-p-reject-evidence-first): RFC 9989 retired pct, so a percentage ramp no longer eases you into enforcement. Walk none → quarantine → reject on aggregate-report evidence instead. (markdown twin: https://dnsdoctor.dev/learn/dmarc-p-reject-evidence-first.md)

### Provider setup

- [Google Workspace: set up SPF, DKIM and DMARC](https://dnsdoctor.dev/learn/google-workspace-spf-dkim-dmarc): The exact SPF, DKIM and DMARC DNS records to authenticate email sent through Google Workspace (Gmail), plus where to paste them and how to verify. (markdown twin: https://dnsdoctor.dev/learn/google-workspace-spf-dkim-dmarc.md)
- [HubSpot: set up SPF, DKIM and DMARC](https://dnsdoctor.dev/learn/hubspot-spf-dkim-dmarc): How to connect a HubSpot email sending domain with the account-specific DKIM CNAMEs, why they earn DMARC alignment, and how to verify it. (markdown twin: https://dnsdoctor.dev/learn/hubspot-spf-dkim-dmarc.md)
- [Mailchimp: set up SPF, DKIM and DMARC](https://dnsdoctor.dev/learn/mailchimp-spf-dkim-dmarc): How to authenticate a domain for Mailchimp campaigns with DKIM, why the CNAME matters for DMARC alignment, and how SPF and DMARC fit in. (markdown twin: https://dnsdoctor.dev/learn/mailchimp-spf-dkim-dmarc.md)
- [Microsoft 365: set up SPF, DKIM and DMARC](https://dnsdoctor.dev/learn/microsoft-365-spf-dkim-dmarc): The exact SPF, DKIM and DMARC DNS records to authenticate email sent through Microsoft 365 (Exchange Online), plus where to paste them and how to verify. (markdown twin: https://dnsdoctor.dev/learn/microsoft-365-spf-dkim-dmarc.md)
- [SendGrid: set up SPF, DKIM and DMARC](https://dnsdoctor.dev/learn/sendgrid-spf-dkim-dmarc): How to set up domain authentication in Twilio SendGrid with its CNAME records, why Automated Security handles SPF and DKIM, and how to verify. (markdown twin: https://dnsdoctor.dev/learn/sendgrid-spf-dkim-dmarc.md)
- [Zoho Mail: set up SPF, DKIM and DMARC](https://dnsdoctor.dev/learn/zoho-mail-spf-dkim-dmarc): The exact SPF, DKIM and DMARC DNS records to authenticate email sent through Zoho Mail, which SPF include to use, and how to verify it. (markdown twin: https://dnsdoctor.dev/learn/zoho-mail-spf-dkim-dmarc.md)

### Comparisons

- [DMARC monitoring tools compared (2026): prices, retention, limits](https://dnsdoctor.dev/learn/dmarc-monitoring-tools-compared): Seven DMARC monitoring tools side by side, from each vendor's own pricing page: entry price, free tier, domains, retention, volume caps, API and agent access. (markdown twin: https://dnsdoctor.dev/learn/dmarc-monitoring-tools-compared.md)
- [dmarcian alternative: DNS Doctor Monitor compared](https://dnsdoctor.dev/learn/dmarcian-alternative): dmarcian Basic: $24/mo, 2 active domains, invalid/warning alerts only. DNS Doctor Monitor: from $12/mo, 10 domains, alerts on DMARC, DNS, blacklists & expiry. (markdown twin: https://dnsdoctor.dev/learn/dmarcian-alternative.md)

### Error pages

- [550 5.7.515: what Microsoft's bounce means and how to fix it](https://dnsdoctor.dev/learn/550-5-7-515): Microsoft's 550 5.7.515 bounce means your sending domain failed the SPF, DKIM and DMARC authentication Outlook.com now requires. The ordered fix path. (markdown twin: https://dnsdoctor.dev/learn/550-5-7-515.md)

### Help

- [DNS Doctor FAQ](https://dnsdoctor.dev/learn/faq): Straight answers on what DNS Doctor checks, whether it touches your DNS, pricing and plans, where report data comes from, and blacklist checking. (markdown twin: https://dnsdoctor.dev/learn/faq.md)

## Methodology

How the verdicts are computed — SPF lookup counting (RFC 7208 §4.6.4), the DMARC alignment gate, and why `temperror` is never a failure: [https://dnsdoctor.dev/methodology](https://dnsdoctor.dev/methodology)

Machine-readable twin (same content, markdown): https://dnsdoctor.dev/methodology.md

## About the company

Independent, subscription-funded, launched 2026. The record engine is deterministic and the AI writes only explanations; details and contact: [https://dnsdoctor.dev/about](https://dnsdoctor.dev/about). Reviews: https://www.trustpilot.com/review/dnsdoctor.dev — open-source agent artifacts: https://github.com/dnsdoctor

## API & MCP

For agents and scripts: a public REST API and an MCP server expose the same deterministic scanner. Every record is generated and validated by a deterministic engine, never a language model.

- [REST API v1 (OpenAPI schema)](https://dnsdoctor.dev/api/v1/openapi.json): Versioned scan, report, DMARC-record and monitoring endpoints (alert log, enforcement readiness, watched lookalikes); anonymous, or a per-account bearer token for the account's own monitoring data.
- [MCP server (streamable HTTP)](https://dnsdoctor.dev/mcp): 27 tools incl. scan_domain, build_dmarc_upgrade, audit_spf_includes, build_parked_domain_records, check_lookalikes, check_bimi, start_email_test + get_email_test, and the token-required account reads get_alerts, get_readiness, get_lookalikes, list_email_tests + list_my_domains. Full list: /llms-full.txt.
- [Use DNS Doctor in ChatGPT](https://chatgpt.com/plugins/plugin_asdk_app_6a60c62613808191b41e39b40625b99f): The DNS Doctor app in the ChatGPT directory: scans, propagation, email tests and lookalikes in chat; connect your DNS Doctor account to add domains and read alerts and readiness.
- [Use DNS Doctor in Claude](https://dnsdoctor.dev/integrations/claude): Setup for claude.ai, Claude Desktop, mobile and Claude Code: adding the connector, what works without an account, and connecting your DNS Doctor account.
- [Full machine contract](https://dnsdoctor.dev/llms-full.txt): The live HTTP contract, the fix-verify loop, and the MCP tool reference.