Domain health reports for SPF, DKIM, and DMARC

Overview

A domain health report grades how well your sender domain is set up to reach the inbox. Every day, Tantra checks the domains behind your connected mailboxes for the three email authentication standards, SPF, DKIM, and DMARC, plus whether your mail servers appear on public spam blocklists. Each domain gets a status of healthy, warning, or critical, and a score out of 100.

These checks are read-only DNS lookups. Tantra never changes your DNS. It tells you what receivers see so you can fix problems before they cost you deliverability.

What each check means

SPF lists which servers are allowed to send mail for your domain. Receivers use it to reject forgeries. A missing SPF record is a serious problem.
DKIM adds a cryptographic signature to your mail so receivers can confirm it was not altered in transit.
DMARC tells receivers what to do when SPF or DKIM fails, and where to send reports. A policy of quarantine or reject is stronger than a policy of none.
Blocklist check. Tantra resolves your mail servers to their addresses and checks them against major public spam blocklists. A listing badly hurts delivery.
MX records show which servers receive mail for your domain. Tantra reads them to run the other checks accurately.

How the score works

Each domain earns points across four areas that sum to 100.

Area	Maximum points	How points are earned
SPF	25	25 when present and clean, 15 when present with warnings, 0 when missing.
DKIM	25	25 when found and clean, 15 when found with warnings, 0 when none found.
DMARC	30	30 for a reject policy, 25 for quarantine, 15 for a policy of none. A few points are deducted for noisy settings.
Blocklist	20	20 when no server is listed, 0 when any server is listed.

How the status is decided

The overall status follows a fixed set of rules, checked in order.

Critical when SPF is missing, or DMARC is missing, or any mail server appears on a blocklist.
Warning when DMARC is set to a policy of none, or when no DKIM record was found while SPF and DMARC are present.
Healthy when SPF is present, DKIM is found, DMARC is present with a policy of quarantine or reject, and no server is listed on a blocklist.

Warnings you may see

The report can flag specific issues beyond present or missing.

More than one SPF record. The standard forbids this, and receivers may pick the wrong one and drop your mail.
An overly permissive SPF setting that allows any server, which is as weak as having no SPF at all.
An SPF record that is too long, which risks evaluation limits.
A missing provider include, when your mail points at Google but your SPF does not include Google's servers.
DMARC applied to only part of your mail, when the percentage setting is below full coverage.
No DMARC report address, so you never see who is sending as you.
A weaker subdomain policy than your main policy.
No DKIM selectors found. Tantra probes common selector names, so this means none of the common ones resolved. It does not prove you have no DKIM at all.
A DKIM key that looks short, which can indicate a weaker key.

What happens next

Tantra runs the full scan automatically once a day, in the early morning, for every connected sender domain. Each run replaces the previous report for that domain, so you always see the latest state rather than a history.

The check also runs on demand. When you request a refresh, Tantra re-scans your domains in the background and updates the reports within a few moments. A domain-by-domain refresh returns right away, and an all-domains refresh runs across every sender domain you have connected.

Unable to verify from the available source code. The exact in-product screen where these domain health reports are displayed to you.

Best practices

Aim for a DMARC policy of quarantine or reject once you are confident your legitimate mail passes. A policy of none only monitors and does not protect your domain.
Fix a missing SPF or DMARC record first. Those drive a critical status and hurt inbox placement the most.
Treat any blocklist listing as urgent. Pause sending from the affected domain and request delisting from the provider that listed it.
Pair strong domain authentication with mailbox warmup. See warm up your sending mailboxes.

Common mistakes

Publishing two SPF records. Merge them into one. Two records break SPF entirely.
Leaving DMARC at a policy of none long term. It gives you reports but no protection.
Assuming a "no DKIM found" result means DKIM is broken. Tantra checks common selector names only, so a custom selector may not be probed.
Ignoring warnings because the status is not critical. Warnings are early signs that erode deliverability over time.

Troubleshooting

Symptom	Cause	Fix
A domain shows critical	SPF or DMARC is missing, or a server is on a blocklist	Publish the missing record, or request delisting, then refresh the domain.
A domain shows warning after adding DMARC	The DMARC policy is set to none	Move the policy to quarantine, then to reject, once your mail passes cleanly.
DKIM shows as not found although you have it	Your selector is not one of the common names Tantra probes	Confirm DKIM signing is active at your provider. A custom selector may not be detected.
Score dropped without a DNS change	A mail server was newly listed on a blocklist, or a resolver hiccup marked a record absent	Refresh the domain. Tantra fails open, so a temporary lookup failure reads as absent and clears on the next run.

FAQ

How often does Tantra check my domains? Automatically once a day, plus any time you trigger a refresh.

Does Tantra change my DNS? No. Every check is a read-only lookup. You make DNS changes at your provider.

Which domains are checked? The domains behind your connected, active sender mailboxes.

Why is only the latest report shown? Each daily run replaces the previous report per domain, so there is no historical trend stored.

What is a blocklist? A public list of mail servers known for spam. Receivers consult these lists, so a listing can send your mail to spam or block it outright.

Will good domain health guarantee inbox placement? No. Authentication is necessary but not sufficient. Sending reputation, content, and warmup all matter too.

Domain health reports (SPF, DKIM, DMARC)