Name: Covenant Systems
Address: US
Price range: $$

Question 1

Why does the SPF lookup limit matter so much?

Accepted Answer

Because it is the failure nobody sees. SPF allows ten DNS lookups per check, and every include: term costs one — including the includes inside the record you included, which belong to your provider and can change without telling you. A business adds Microsoft 365, then an email marketing service, then invoicing software, then a booking system, and somewhere in there the total passes ten. At that point the check returns a permanent error and receiving servers treat every message as unauthenticated. The record still reads perfectly in a control panel: one line naming all the right providers. Most free checkers read only the top-level record, count the terms they can see, and pronounce it fine. This one walks the whole chain and tells you which term tipped it over.

Question 2

Does the domain I type get sent anywhere?

Accepted Answer

Yes, and unlike our other tools it has to be. Checking DNS means asking a DNS server. What we can control is who. The lookups go straight from your browser to a public resolver — Cloudflare first, Google if that fails — so they do not pass through us, we never see the domain, and we have nothing to log or hand over. If your browser or an extension blocks that request, the tool falls back through our own endpoint and says so on the result rather than quietly changing what it promised. That endpoint accepts a hostname and a record type from a fixed list and nothing else; it cannot be pointed at an internal address or an arbitrary port.

Question 3

Why can't you just tell me if DKIM is set up?

Accepted Answer

Because DKIM cannot be enumerated. A DKIM key lives at selector._domainkey.yourdomain, and there is no record anywhere that lists which selectors exist — the only way to check one is to already know its name. So the tool tries the selectors the common providers use and reports exactly that: which ones it tried and which answered. Silence means the guesses missed, not that you have no DKIM. If you know your selector, enter it and it will be checked directly. Any tool that reports "no DKIM" from a failed guess is telling you something it cannot know.

Question 4

What is the difference between SPF, DKIM and DMARC?

Accepted Answer

SPF lists which servers are allowed to send as your domain. DKIM puts a cryptographic signature on each message so a receiver can tell it was not altered and did come from you. DMARC is the one that makes either of them matter: it tells receiving servers what to do when a check fails, and asks them to report back. Without DMARC, a failed SPF check is a suggestion most receivers ignore. That is why a domain with a perfect SPF record and no DMARC is still trivially spoofable — and spoofed invoices are the reason this matters to a small business rather than just to an IT department.

Question 5

My DMARC says p=none. Is that fine?

Accepted Answer

It is the right place to start and the wrong place to stay. p=none is monitoring: it asks for reports but instructs receivers to do nothing about failures, so it stops nobody from sending as you. The usual path is to publish p=none with a reporting address, read the reports for a few weeks until you are confident every legitimate sender passes, then move to quarantine and finally reject. Plenty of domains publish p=none, never look at a report, and believe they are protected. They are not — but they are one setting away from being so.

Question 6

How much of this has been tested?

Accepted Answer

The SPF logic — the chain walk and the lookup counting, which is the part worth having — is verified against records whose true cost is known by construction, including a chain built to sit exactly at ten and another built to sit at eleven. Those tests run offline against a fixed table of records rather than the live internet, which is what makes them repeatable. What that does not cover is how real resolvers behave on real domains: we could not exercise that from our own build environment, so if something reads oddly on your domain we would genuinely like to know.

Question 7

What should I actually do with the result?

Accepted Answer

The critical findings first, in the order shown — they are the ones actively costing you delivery. Most are a single DNS record change at whoever hosts your domain, and the tool tells you what the record should say rather than only that it is wrong. If the SPF lookup count is the problem, the fix is usually to remove providers you no longer use, or to replace a provider's include with the IP ranges it resolves to. If that sounds like something you would rather not do at 9pm on your registrar's control panel, that is what the button below is for.

Why your email lands in spam

The interesting part is the failure you cannot see

How to read it

What costs a lookup

Questions