Scanning
Scanning your domain…
Checking SPF, DMARC, DKIM, MX, DNS, blacklists and domain & SSL expiry. A domain we haven't scanned before takes a few seconds — hang tight.
Checking SPF, DMARC, DKIM, MX, DNS, blacklists and domain & SSL expiry. A domain we haven't scanned before takes a few seconds — hang tight.
Scanned Oct 31, 2026 00:06 UTC · 7 checks · public report
Solid base — three policy steps remain.
i.ua publishes DMARC with p=none — spoofed mail is monitored but not blocked.
Your SPF setup is currently neutral at the end, which means mail that is not explicitly allowed is treated as “not approved,” but not as a hard block. This still works for DMARC, but it is less strict than it could be. If you want stronger protection against spoofing, you can change it to a hard-fail policy once you are sure every legitimate sender is included in the allowed list.
v=spf1 ip4:91.198. DMARC is set up, but it is only in monitoring mode, so it is not actually blocking fake or spoofed emails. This matters because attackers can still send messages that look like they came from your domain, which can hurt trust and deliverability. The fix is to change the DMARC policy from monitoring to an enforcement mode so failing mail is rejected or quarantined instead of just reported.
What DNS shows against each provider's published rules. Not a compliance verdict.
All 4 met
We email you a link to the full report, with every finding and fix. Opening it signs you in to a free account and starts a 14‑day Monitor trial. No card, and you can unsubscribe in one click.
Check SPF, DMARC, DKIM, MX, DNS health, blacklists and domain & SSL expiry in one free scan, with the exact record to paste for each problem it finds.
Domain owner? Re-scan any time, or email hello@dnsdoctor.dev to have this page removed.
Edit your SPF record at Cloudflare — step-by-step guide.
v=DMARC1; p=none; rua=mailto:dmarc-rua@mi6.kiev.uaEdit your DMARC record at Cloudflare — step-by-step guide.
This means your email signing key for the “mail” DKIM selector is too short and easier to break than modern standards recommend. That matters because weaker DKIM keys reduce trust in your outgoing mail and can increase the risk of spoofing or mail being rejected in the future. The fix is to replace it with a stronger DKIM key, usually by generating a new key pair and updating the selector in your DNS and mail server settings.
Publish your DKIM record at Cloudflare — step-by-step guide.
All 4 met
All 3 met
All 3 met
Send one real email and see how Gmail, Yahoo, Outlook and Apple are likely to treat it.DNS can't show these 4. One real message can.
Send a test emailSpam complaint rate stays under 0.3%Only each provider's own sender tools show this. All senders at Gmail, Yahoo.
How we read these: sender rules in our methodology. Each provider's rules: Gmail · Yahoo · Outlook · Apple