An illustrative, public-DNS-only example of the client-ready pack we prepare manually during the preview. Sample data only — not real customer data. No login required, no messages sent, no records changed, no personal data needed.
Prepared for Sample Agency · 3 client domains · public DNS only
1 · Executive summary
Executive summary
1At risk
1Needs work
1Healthy
Across 3 client domains, 2 need attention. Start with the at-risk domains in the worst-first ranking below, then work through the priority fix brief. Public DNS only, recommendations only.
2 · Worst-first ranking
Worst-first client-domain ranking
The client domains ranked highest-risk first — where to start.
3Domains checked
1Urgent
1Needs work
1Healthy
Fix these first:no-protection.example (44), setup-gaps.example (75)
Domain
Score
Status
Top issue
Top fix
Issues
no-protection.example
44/100
✕At risk
Single SPF record
Merge duplicate SPF records
2 critical · 1 warning
setup-gaps.example
75/100
!Needs work
DMARC policy
Strengthen your DMARC policy
1 critical · 1 warning
healthy-agency.example
100/100
✓Healthy
No urgent issues
None needed
None
3 · Priority fix brief
Priority fix brief
The highest-impact fixes first, per domain.
no-protection.exampleMerge duplicate SPF records
no-protection.examplePublish a DMARC record
setup-gaps.exampleStrengthen your DMARC policy
setup-gaps.exampleReduce SPF DNS lookups
4 · Per-domain findings
Sample per-domain findings
The full read for each client domain — the sections above summarize these.
Healthy domain
SPF, DKIM, DMARC and MX are all configured the way email providers expect.
100/100
Healthy
This domain's core email authentication looks healthy.
healthy-agency.example · DKIM selector: default
Client-ready summary
healthy-agency.example is in good shape for email deliverability: SPF, DMARC and MX are configured the way mailbox providers expect. No urgent changes are needed — keep this setup as your sending evolves.
No urgent fixes found. Keep an eye on this as your sending setup changes.
All checks
Mail servers (MX)✓Pass
Found 1 mail server record for this domain.
SPF record✓Pass
An SPF record is published for this domain.
SPF DNS-lookup limit✓Pass
SPF uses about 2 DNS lookups, within the limit of 10.
This is an estimate of top-level lookups; nested includes can add more.
SPF enforcement✓Pass
SPF ends with "-all", so servers that are not listed are rejected (hard fail).
Detected sending sourcesiInfo
SPF references 2 sending sources.
Detected includes: _spf.mail-provider.example, _spf.backup-provider.example. Confirm these match the services you actually send through.
DMARC record✓Pass
A DMARC record is published at _dmarc.healthy-agency.example.
DMARC policy✓Pass
DMARC policy is "reject" - the strongest protection.
DKIM✓Pass
A DKIM record was found for selector "default".
Domain with gaps
The basics exist, but an over-long SPF record and a monitor-only DMARC policy leave gaps.
75/100
Needs work
This domain has some email authentication gaps to fix.
setup-gaps.example
Client-ready summary
setup-gaps.example needs work. Start with your top fix — Strengthen your DMARC policy — then work through the prioritized fixes below. Closing these lowers the chance of legitimate email landing in spam.
Top fixes
Strengthen your DMARC policyA policy of "none" only monitors. Once your sources pass authentication, move to "p=quarantine" and then "p=reject". If the policy is inherited from your main domain, update it there (or publish a record for this subdomain).
Reduce SPF DNS lookupsSPF allows at most 10 DNS lookups. Remove unused "include:" entries or flatten them so sending does not silently fail.
All checks
Mail servers (MX)✓Pass
Found 1 mail server record for this domain.
SPF record✓Pass
An SPF record is published for this domain.
SPF DNS-lookup limit✕Action needed
SPF uses about 11 DNS lookups, over the limit of 10.
Above 10 lookups SPF fails with a permanent error. This is an estimate of top-level lookups; nested includes can add more.
SPF enforcement✓Pass
SPF ends with "~all", so mail from servers that are not listed is soft-failed (marked suspicious, not rejected).
Detected sending sourcesiInfo
SPF references 11 sending sources.
Detected includes: a.example, b.example, c.example, d.example, e.example, f.example, g.example, h.example, i.example, j.example, k.example. Confirm these match the services you actually send through.
DMARC record✓Pass
A DMARC record is published at _dmarc.setup-gaps.example.
DMARC policy!Needs attention
DMARC policy is "none" - it monitors only and does not yet protect this domain.
Once your legitimate sources pass authentication, move the policy to "quarantine" and then "reject".
DKIMiInfo
DKIM was not checked because no selector was provided.
DKIM records live at "<selector>._domainkey.<domain>". Enter the DKIM selector from your email provider to include this check.
Exposed domain
Open to spoofing: duplicate SPF records, a wide-open rule, and no DMARC at all.
44/100
At risk
This domain has serious email authentication problems.
no-protection.example
Client-ready summary
no-protection.example is at risk. Start with your top fix — Merge duplicate SPF records — and work down the prioritized fixes below. Until these are addressed, this domain is more exposed to spoofing and spam filtering.
Top fixes
Merge duplicate SPF recordsOnly one SPF record is allowed. Combine every "v=spf1" record into a single TXT record, then remove the extras.
Publish a DMARC recordAdd a TXT record at "_dmarc.<your-domain>" starting with "v=DMARC1; p=none;" to begin monitoring, then strengthen it over time. Publishing it on your main domain also covers subdomains that have no record of their own.
Tighten the SPF ruleEnding SPF with "+all" lets anyone send as your domain. Use "-all" (strict) or "~all" (soft fail) instead.
All checks
Mail servers (MX)✓Pass
Found 1 mail server record for this domain.
SPF record✓Pass
An SPF record is published for this domain.
Single SPF record✕Action needed
More than one SPF record was found, which breaks SPF entirely.
Receivers ignore SPF when a domain has multiple records. Merge them into one record beginning with "v=spf1".
SPF DNS-lookup limit✓Pass
SPF uses about 1 DNS lookup, within the limit of 10.
This is an estimate of top-level lookups; nested includes can add more.
SPF enforcement!Needs attention
SPF ends with "+all", which lets any server send as this domain.
Use "-all" (strict) or "~all" (soft fail) so unauthorized servers are not allowed to send as this domain.
Detected sending sourcesiInfo
SPF references 1 sending source.
Detected includes: mailer.example. Confirm these match the services you actually send through.
DMARC record✕Action needed
No DMARC record was found at _dmarc.no-protection.example.
DMARC tells receivers what to do with mail that fails authentication and gives you visibility into spoofing.
DKIMiInfo
DKIM was not checked because no selector was provided.
DKIM records live at "<selector>._domainkey.<domain>". Enter the DKIM selector from your email provider to include this check.
5 · Next steps
Client-facing next steps
Fix the at-risk domains first, starting with the priority fix brief above.
Publish or tighten DMARC so spoofing is monitored, then enforced.
Keep SPF within the 10-lookup limit and remove any duplicate records.
Re-check after changes — public DNS only, recommendations only.
This is a sample pack. The paid Agency Deliverability Audit Pack is prepared manually during the preview from the same public-DNS checks. See the $149 one-time pack →