Record guide
The records that decide whether your mail and site are trusted.
Plain-English notes on what the report checks. The standards behind them: RFC 7208 (SPF), RFC 7489 (DMARC), RFC 6376 (DKIM), RFC 8461 (MTA-STS), RFC 8460 (TLS-RPT), RFC 6797 (HSTS), RFC 8659 (CAA), RFC 7505 (null MX), RFC 9083 (RDAP).
- MX Mail servers
- Lists the servers that accept email for your domain, in order of preference. No MX means the domain receives no mail. A "null MX" (0 .) says so explicitly.
- SPF Sender list
- A TXT record starting v=spf1 that lists the servers allowed to send mail as your domain, ending in ~all or -all. Only one is allowed, and checking it may take at most 10 DNS lookups; every include: counts, and so do the includes inside it.
- DMARC Spoofing policy
- A TXT record at _dmarc that tells receivers what to do with mail that fails SPF and DKIM: p=none (just report), p=quarantine (spam folder) or p=reject (refuse). rua= is where daily reports go. Start at none, read the reports, then tighten.
- DKIM Signing key
- Your email provider signs each message; the public key sits at <selector>._domainkey. A signature survives forwarding, which SPF does not. Turn it on in your provider's admin page; it gives you the record.
- MTA-STS Encrypted delivery
- A TXT record at _mta-sts plus a small policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt. Together they tell other servers to deliver your mail only over verified encryption.
- TLS-RPT Delivery reports
- A TXT record at _smtp._tls asking other servers to send you a daily summary of encryption problems delivering to you.
- HTTPS Secure website
- Your bare domain (no www) should answer on https:// with a certificate a browser trusts, send http:// visitors to https://, and send the Strict-Transport-Security header so browsers remember.
- CAA Certificate authorities
- Names the certificate authorities allowed to issue certificates for your domain. Optional; it narrows who could be tricked into issuing one.
- RDAP Registration
- The registry's own record of your domain, including the date it must be renewed by. If it lapses, website and email stop together.
Where do I make the change?
At your DNS host: usually the company you bought the domain from, or your web host if the domain's name servers point there. Look for "DNS", "Zone editor" or "Manage DNS". Add or edit the record with the host name and text the report gives you. Changes can take from minutes to a day to reach every server; run the check again after that.