# DNS Autopilot > DNS Autopilot is a free domain health check and monitor: it scores a domain from 0 to 100 on 40+ email, DNS, certificate, and registration checks with the exact record for each fix, re-checks it daily, and reads your DMARC reports to show which senders fail and when it is safe to move to p=reject. How healthy is your domain?. One check scores your domain from 0 to 100 across its email, its DNS security, and the website behind it: DMARC, SPF, DKIM, MX, MTA-STS, TLS-RPT, DNSSEC, CAA, blocklists, certificates, and registration. Every fix comes with the exact record to publish. 40+ checks, no account, free, about 3 seconds. Add a domain to a free account and DNS Autopilot re-checks it every day and reads its DMARC reports; Gmail connect (Pro and Agency, plus the 14-day trial) needs no DNS change and reads only DMARC report emails. ## Example report This is an example for acme.example, a typical Google Workspace domain. Every fix lists the record to publish and the points it adds. Each fix lists the DNS record to publish and the points it adds. Scores are weighted across five areas: email authentication 35%, mail servers 20%, mail in transit 15%, DNS 15%, and domain and website 15%. ## One score for the health of your domain A domain is more than its website. The check reads five areas and weights them into one score, so you see what to fix first. - **Email authentication (35%).** DMARC record, policy, and subdomain policy, Report addresses and their authorization, SPF record, lookup count, and ending, DKIM on 16 common selectors, BIMI. - **Mail servers (20%).** MX records, Reverse DNS of the mail server, 8 blocklists. - **Mail in transit (15%).** STARTTLS, by mail provider, MTA-STS, TLS-RPT, DANE. - **DNS security (15%).** DNSSEC, Nameservers, CAA, SOA. - **Domain and web (15%).** Registration expiry and age, Transfer lock, HTTPS certificate, IPv6. Email is the deepest area today: it also reads your DMARC reports to show which senders fail. We plan to add other kinds of checks over time, such as uptime, AI crawler access, and SEO. ## See every server that sends mail as your domain DNS tells you what you published. Your DMARC reports tell you what actually happened to your mail. - **Every sender, named.** Google Workspace, Amazon SES, Mailchimp, HubSpot, Shopify, and unknown IPs, with pass rates. - **One fix per failing sender.** The exact record to add, in one sentence. - **A yes or no for p=reject.** 30 clean days, 500 messages from two reporters, and the record to publish. Sample, last 30 days: Google Workspace 4,210 messages (Aligned); Amazon SES 1,180 messages (Aligned); Mailchimp 640 messages (Fails DKIM); Unknown 37 messages (Fails both). Free for one domain. Gmail connect on Pro and Agency, plus the 14-day trial. ## It keeps checking after you close the tab DNS Autopilot re-checks your domain every day and reads new DMARC reports as they arrive. When something changes, you hear about it before your mail does. Alerts by email: - **A new sender is failing DMARC.** Mailchimp, 640 messages failed DKIM - **The pass rate dropped.** From 97% to 89% in a week - **Your DMARC record changed.** p=none to p=quarantine, edited at your DNS host - **The health score dropped.** 83 to 76: the HTTPS certificate expires in 10 days - **The domain is close to expiry.** acme.example expires in 21 days - **A mail server is on a blocklist.** 198.51.100.24 is listed - **Gmail disconnected.** Reconnect to keep reading reports - **Ready for the next policy.** acme.example can move to p=reject A weekly digest arrives every Monday with your score, mail volume, pass rate, and new senders. https://dnsautopilot.com/login ## Built for whoever owns the domain - **Small business owners and office managers.** You send from Google or Microsoft plus a few tools, and nobody has time to read XML. See each sender in plain words, fix what fails, and get a yes or no on the next policy step. - **Agencies, MSPs, and IT providers.** You run email for clients and need proof the work is done, without a login per client. Agency plan: up to 100 domains, domains grouped by client, and a weekly digest per client. - **Marketing and ecommerce teams.** A newsletter tool, a CRM, or a store platform sends as your domain and mail lands in spam. Find the sender that fails alignment, with one sentence on the DNS record to add. - **SaaS and developer teams.** Transactional mail goes out through services such as Amazon SES or SendGrid, and one bad record breaks it. Watch SPF lookups, DKIM keys, and pass rates, and get an alert when a new sender fails. ## How it works From sign-in to your first readiness result takes a few minutes. 1. **Get your reports in.** Connect Gmail and DNS Autopilot finds the report emails itself, with no DNS change. Or add your report address, token@rua.dnsautopilot.com, to the rua tag of your DMARC record. That works with any mailbox, including Microsoft 365. 2. **See every sender.** Reports are checked, unpacked, and grouped by sending source, with the service behind each one and a one-sentence fix for anything that fails. 3. **Tighten the policy.** When the numbers are good, DNS Autopilot shows the exact record to publish for p=quarantine, then p=reject. ## Everything it does One health view per domain: its score, its senders, and the next safe step. - **Gmail connect (Pro and Agency).** Read-only access to DMARC report emails and nothing else. 3 Gmail mailboxes, synced hourly; Agency allows 10. It is on the trial and paid plans until Google verifies the app. - **Your own report address.** Every account gets token@rua.dnsautopilot.com. Add it to your DMARC rua tag and reports arrive without any mailbox access. - **Every report format.** Zip, gzip, and plain XML from any provider, unpacked in memory with limits on size and compression ratio. - **Forged reports kept out.** Each report email is checked against the reporting provider's own authentication. Reports that fail the check are stored but never count toward readiness. - **The service behind each IP.** Sending IPs are named through reverse DNS and DKIM domains: Google Workspace, Microsoft 365, Amazon SES, SendGrid, Mailchimp, HubSpot, Shopify, and more. - **Forwarders and mailing lists labeled.** Mail relayed by Google Groups, iCloud, Fastmail, and mailing list software is marked as forwarded, so it does not look like an attack. - **An A to F grade per domain.** Built from your policy, the 30-day pass rate, DNS problems, and the share of mail from unknown failing senders. - **Readiness for quarantine and reject.** A plain yes or no with reasons: at least 98 percent of mail from known senders passing, 500 messages from two reporters, over 14 days for quarantine and 30 for reject. When it is yes, you get the exact record to publish next. - **One fix per failing sender.** Each known service that fails comes with a sentence on what to change. Unknown senders are flagged as possible spoofing. - **A daily health score.** Every domain you add is re-checked each day against 40+ checks: DMARC, SPF, DKIM, MX, MTA-STS, TLS-RPT, DNSSEC, CAA, blocklists, certificates, and registration. The score from 0 to 100 keeps its history, and each fix shows the points it adds. - **Alerts (Pro and Agency).** Email when a new sender starts failing, the pass rate drops, your DMARC record changes, the health score drops or a check starts failing, Gmail disconnects, or a domain becomes ready for its next policy. - **Weekly digest (Pro and Agency).** A weekly summary of mail volume, pass rate, new failing senders, and readiness. On Agency it is sent per client. - **CSV export and raw XML (Pro and Agency).** Download any report as CSV or as the original XML. - **Client grouping (Agency).** Name your clients, assign each domain to one, and manage up to 100 domains. - **History.** 30 days on Free, 13 months on Pro, 25 months on Agency. - **A free check with no account.** Score any domain from 0 to 100 in about three seconds, with the exact record for each fix. Twenty checks an hour, no sign-up. ## Privacy and trust You are handing over a view of your mail, so the limits are narrow and written down. - **Read-only Gmail.** The only scope is gmail.readonly, requested only when you connect a mailbox. - **Only DMARC report emails.** One fixed search finds report attachments. Other mail and message text are never read. - **Limited Use.** Use of Google data follows the Google API Services User Data Policy, including the Limited Use requirements. It is not sold or used for advertising. https://developers.google.com/terms/api-services-user-data-policy - **Delete everything yourself.** Settings removes your reports, domains, Gmail connection, and tokens at any time. - **Hosted in the United States.** On Google Cloud. Payments run through Stripe, so we never see your card number. ## Why DNS Autopilot Most teams start with raw reports or a free viewer, or get quoted for an enterprise platform. This sits between them. **Reading XML by hand or a one-off viewer:** Raw rows, no verdict on what to do; No memory between uploads; No check that the report is real. **Enterprise DMARC platforms:** Sales call and contract first; Built for large security teams; Charts to interpret yourself. **DNS Autopilot:** Self-serve, flat $19 or $49 a month, cancel any time; Readiness answers, not just charts; Free for one domain. ## Start free. Pay when you watch more domains. Start free with one domain. Pro adds alerts, the weekly digest, longer history, and Gmail connect, with a 14-day trial that needs a card. Cancel any time from Billing. - **Free**: $0, 1 domain. - **Pro**: $19 a month, 10 domains. - **Agency**: $49 a month, 100 domains. Compare every limit: https://dnsautopilot.com/pricing ## FAQ ### What are DMARC reports? When a domain publishes a DMARC record with an rua address, mailbox providers such as Google, Microsoft, and Yahoo send a daily zipped XML report to that address. Each report lists the servers that sent mail as your domain and whether that mail passed SPF and DKIM alignment. They are accurate and almost unreadable, which is why most domains never look at them. ### What does DNS Autopilot read in Gmail? Only DMARC report emails. It runs one fixed search for messages with a report-style subject and a .xml, .gz, or .zip attachment, then reads the sender, subject, date, authentication headers (Authentication-Results and ARC), and those attachments. It never reads other mail or any message text. The exact query is on the Gmail page, and you can disconnect at any time. ### What if I do not use Gmail? Every account gets a report address of the form token@rua.dnsautopilot.com. Add it to the rua tag of your _dmarc record and reports arrive there directly. It works with any mailbox, and it is the better route when the mailbox belongs to a client or a shared inbox. ### How does DNS Autopilot decide a domain is ready for p=reject? It looks only at reports it can verify came from the reporting provider, and it leaves known forwarders out of the count. A domain is ready for quarantine when at least 98 percent of the mail from known senders passed for 14 days with no sender left to fix, and ready for reject on the same test over 30 days. It also needs at least 500 messages from at least two reporters in that window. Each result lists the reasons in plain sentences. ### How long is my data kept? Parsed reports and their raw attachments are kept for 25 months. Gmail message ids, used only to avoid importing a report twice, are kept for 60 days. You can delete everything from Settings at any time, including the Gmail connection and the stored reports. ### How does the free trial work, and how do I cancel? Pro starts with a 14-day trial that needs a card and includes Gmail connect. Cancel from Billing at any time: you keep the plan until the end of the period you paid for, and a trial cancelled in time is not charged. There is no contract. ### Do I need an account to run the check? No. Enter a domain on the check page and in about three seconds you get a score from 0 to 100 across more than 40 checks: DMARC, SPF, DKIM, MX, reverse DNS, blocklists, STARTTLS, MTA-STS, TLS-RPT, DNSSEC, CAA, the HTTPS certificate, and registration. Each problem comes with the exact record to publish. It is limited to 20 checks an hour per visitor. ### How is the health score calculated? Every check passes, warns, or fails. They fall into five areas, and the overall score weights them: email authentication 35%, mail servers 20%, mail in transit 15%, DNS security 15%, and domain and website 15%. Each fix shows the points it adds, and the fix plan shows the score you would reach with all of them applied. ### Who is DNS Autopilot for? Small businesses that send mail through a handful of services such as Google Workspace, a CRM, a newsletter tool, and a store, and the agencies and IT providers that run email for them. The Agency plan groups domains by client and sends a digest per client. ### Will moving to p=reject break my email? It can if a real sender is not aligned, which is why DNS Autopilot only says a domain is ready when known senders pass and no known service is still failing. Go in steps: p=quarantine first, then p=reject. Each step comes with the exact record to publish, and you can go back to the previous policy by editing the record. ### Do I need to change my DNS? With Gmail connect, no: reports are read from your mailbox. With the report address you change one thing, the rua tag of your _dmarc record, to include token@rua.dnsautopilot.com. DNS Autopilot only reads public DNS records and never changes them; you publish any later policy change yourself. ### Does it work with Microsoft 365 or Outlook? Yes, through the report address, which works with any mailbox and any DNS host. Gmail connect is for Google mailboxes only. Microsoft 365 mail is recognized as a sending source, and the setup guide lists where to edit the DMARC record at common DNS hosts. ### Can I manage client domains? Yes, on the Agency plan: up to 100 domains, grouped by client, with a weekly digest per client. Point each client's rua tag at your report address, or connect a mailbox that already receives their reports. ### Does it work with senders like Amazon SES, SendGrid, or Mailchimp? Yes. It names the service behind each sending IP, shows whether SPF or DKIM aligned, and says what to change when it did not. It also checks your SPF lookup count against the limit of 10 and the DKIM keys for the selectors seen in your reports. ## More - [Start free](https://dnsautopilot.com/login) - [Free domain health check](https://dnsautopilot.com/check) - [Pricing](https://dnsautopilot.com/pricing) - [Privacy policy](https://dnsautopilot.com/privacy.md) - [Terms of service](https://dnsautopilot.com/terms) - [Set up DMARC reports](https://dnsautopilot.com/docs/setup.md): Connect Gmail or point your DMARC record's rua tag at your DNS Autopilot address. - [What DNS Autopilot reads in Gmail](https://dnsautopilot.com/docs/gmail.md): Exactly which Gmail messages DNS Autopilot searches, what it reads, and what it never touches. - [Pricing](https://dnsautopilot.com/pricing.md): Free for one domain; Pro $19 a month with a 14-day trial; Agency $49 a month for 100 domains and clients. - [Free domain health check](https://dnsautopilot.com/check.md): Score any domain from 0 to 100 on email authentication, mail servers, transport security, DNS, and registration, with the exact record for each fix. No sign-up. - [DNS and email health guides](https://dnsautopilot.com/blog.md): Plain guides to SPF, DKIM, DMARC, MTA-STS, DNSSEC, and the rest of a domain's email and DNS health, from the team that builds DNS Autopilot. - [From DMARC p=none to p=reject: a safe step-by-step path](https://dnsautopilot.com/blog/dmarc-p-none-to-p-reject.md): Move DMARC from p=none to p=reject without losing legitimate mail: collect reports, fix senders, then quarantine and reject, with clear criteria for each step. - [MTA-STS and TLS-RPT: how to require TLS for mail to your domain](https://dnsautopilot.com/blog/mta-sts-and-tls-rpt.md): Set up MTA-STS and TLS-RPT step by step: the DNS records, the mta-sts.txt policy file, a safe testing-to-enforce rollout, and the mistakes that break mail. - [SPF's 10 DNS lookup limit: why SPF breaks and how to fix it](https://dnsautopilot.com/blog/spf-10-dns-lookup-limit.md): SPF allows 10 DNS lookups. Go over and it returns permerror, which can fail DMARC. See what counts, how to count yours, and how to fix it safely. - [About DNS Autopilot](https://dnsautopilot.com/about.md): DNS Autopilot is a free domain health check and monitor, built and run by agntwrk, a software studio in Denver.