Real example · not a customer
We ran the free check on our own domain
28in28.ai, checked on 30 October 2026 at 18:50 UTC (report 1a14a4534d24) from public DNS. Overall: the bulk-sender basics pass (SPF, DKIM for both the mailbox provider and the newsletter service, and DMARC exist), with one medium risk left.
Correction: an earlier run at 18:30 UTC (report 619fe56089f4) reported “no DKIM for the mailbox provider”. That was a fault in our check, not in the domain: Namecheap signs newer Private Email subscriptions with the selector privateemail, which the check did not yet look for. Fixed the same evening; the result below is the corrected one.
What public DNS shows
What the check found
- Medium — DMARC only monitors.
p=nonemeets the bulk-sender minimum but does not stop spoofing. Plan: after at least 14 days of reports in which every legitimate source passes aligned,p=quarantine; pct=25, then 100, thenp=reject. - Info — no MTA-STS. Optional; inbound TLS could be downgraded.
What the check cannot see
Whether our real messages pass SPF or DKIM aligned with the From domain needs a sent message's headers or DMARC reports. Inbox placement also depends on content, list quality and sender reputation; this check does not and cannot prove it.
What happens next
The remaining step is the DMARC plan above: we read the aggregate reports for at least 14 days, then tighten the policy and re-check from public DNS. Each re-check will be added here with its own report ID — whether it passes or not.