Domain health and Monitoring

Analyse the public DNS of a domain, understand what is wrong and copy the exact records to fix it. Then watch the domain so MailSolid warns you when it changes.

MailSolid · User guideReviewed for version 0.15.1

Who can do it: any member of the workspace. The number of domains you can watch depends on your plan.

Before you start: you need the name of a domain you send or receive email with, for example example.com. MailSolid only reads public DNS: it does not ask for access to your mailbox or to your DNS provider.

Analyse a domain

Open Domain health in the sidebar (or press Check a domain in Home).
Enter the domain and press Analyse. Reading the DNS takes a few seconds.
The report of the analysis opens.

If that domain was analysed less than 10 minutes ago and you do not watch it, the console reuses the recent report and tells you so. If you do watch it, analysing it runs the same check as Run now (see below). The workspace has an hourly limit on analyses.

Below the form, Your domains lists everything you have analysed, with its counts and a mark showing whether it is watched.

Read the result

The verdict comes first. The title at the top sums up the worst case:

Verdict	What it means
Critical problems found / Serious problems found	The worst failed check is of critical or high severity.
Needs attention	The worst one is of medium severity.
Minor problems found	There are only low-severity problems.
Looking good	No check failed. If there are optional improvements, the text says so.
Not enough data for a verdict	Not enough of the domain could be checked. Analyse again in a few minutes.

With problems, the Worst severity (Critical, High, Medium or Low) appears on the right. Below there is a bar with one segment per check, grouped in three groups (Authentication, Transport and Protection), and the counts of problems, suggestions, passed and not checked. The segments are named when you hover or focus them with the keyboard, and they lead to their row.

The checks in the list are presented in five areas, with the problems first and from most to least serious:

Area	Checks	Group in the bar
Email authentication (who can send as you)	SPF, DKIM, DKIM key strength, DMARC and Email providers.	Authentication
Receiving mail	MX records and MX addresses.	Transport
Secure transport	MTA-STS, TLS-RPT, DANE and SMTP and STARTTLS.	Transport
Domain protection and brand	DNSSEC, CAA and BIMI.	Protection
Reputation	Blocklists.	Protection

Each check ends in one of these states: Passed, Problem (with its severity), Suggestion (an optional improvement) or Not checked.

“Not checked” never counts as a problem or as a pass. Two checks always show it, by design, and that is normal:

Blocklists: blocklists require a licence for commercial use, so they are not checked.
SMTP and STARTTLS: the probe is not run because this service cannot open port 25; MTA-STS, TLS-RPT and DANE cover transport security.

If the report also shows the yellow warning “Part of the DNS could not be read this time”, some more checks came out as not checked for that reason: in that case, analyse again in a few minutes.

Copy the records to fix it

When something needs fixing, the report includes Records for your DNS: a table with the Type, Name, Value and Status of each record. The status is Missing (it does not exist) or To change (it exists and must be replaced).

Every cell has a copy button. Copy the record (or Copy the N records, if there are several) copies everything at once, in DNS zone format.
Paste the record in your DNS provider’s panel. If your panel adds the domain by itself, use the short name (Name in your DNS panel); if not, use the full name.
Some records have an underlined part you can change (for example, an address). The record and the copy button update as you type; if the value is not valid, the default is used.
Some fixes also need a file (for example, the MTA-STS policy): the report gives you its address and its content.
Once you publish it, press Analyse again to check it. DNS can take a few minutes to show the change.

There are fix cards for DMARC, MTA-STS, TLS-RPT, CAA and BIMI, and a single SPF record that covers all your senders (with a warning if it would need more than 10 DNS lookups, which is the limit). MailSolid never changes your DNS: it only gives you something to copy.

Download the report and check the history

Download PDF generates a PDF of the report.
History of this domain (when there is more than one analysis) lists the earlier analyses. If you are viewing an old one, a notice tells you and takes you to the latest with Open the latest report.
Analyses are kept for 12 months.

Watch the domain

Watching a domain analyses it again every day and warns you when it changes.

In the report or in the lists, press Watch. You can also go to Monitoring and use Watch a domain.
The first check usually takes less than a minute. The problems the domain already had are recorded once, at the start, as Already failing.
From then on, every day it is compared with the last known state.

In Monitoring, each watched domain shows since when it is watched, the last and the next check, and its Recent changes:

Change	What it means
New problem	A check that was fine now fails.
Got worse / Got better	The severity of a problem went up or down.
Fixed	A problem went away.
Record changed / Record gone	A DNS record changed or no longer exists.
Already failing	A problem the domain already had when you started watching it.
Certificate expiring / Certificate renewed	The brand certificate (BIMI) is close to expiring or was renewed. Only its date is read.
Not checked	No answer was obtained from the DNS in the last 3 checks. It is not a problem of the domain and we keep trying.

The time of the daily check (UTC) and the time zone are changed in Settings (for the owner and the admins).

Run now

Run now checks a watched domain at that moment. It does the same work as the daily check: it queries the DNS, compares, records the changes and sends the alerts that apply, without moving the next scheduled check. Each domain can be checked once every 10 minutes, and the workspace also has an hourly limit; if you go over, the console tells you how many minutes to wait. When it finishes, you can open the latest report.

Plan limit and stop watching

Monitoring shows how many domains you watch out of what your plan allows. If your plan allows fewer domains than you watch, the newest ones are Paused by plan: they are saved but not analysed and send no alerts, and they start again by themselves when the plan allows it.
Stop watching asks for confirmation. You stop getting alerts for that domain; its earlier analyses stay in Domain health, but its list of changes is cleared.
Remove from workspace, on the domain page in Domains (owner or admin), removes the domain from everywhere at once: monitoring, DMARC reports, saved diagnoses and domain groups. Your DNS is not changed. If the domain has hosted DMARC or hosted MTA-STS, withdraw them first from their screens.

If something fails

“Enter a valid domain name”: check that there are no spaces or full page addresses; example.com is enough.
“Too many analyses this hour”: wait a while and try again.
“The service is very busy”: try again in a few minutes.
“A monitoring check is already running. Open Monitoring to follow it.”: follow it there; do not submit it again.
“This analysis is less than 10 minutes old”: if you press Analyse again right after an analysis, it is still the latest. Try again in a few minutes.
“Blocklists” and “SMTP and STARTTLS” show as “Not checked”: that is normal and not a failure (see above). Only if the report shows the yellow warning “Part of the DNS could not be read this time”, analyse again in a few minutes.
A domain is paused: your plan does not cover that domain right now; check Plan.

Organize Monitoring by client

Under Watched domains, use Domain group to view a portfolio or client. Manage domain groups opens the list: members can read it and owners/admins can change it. Clear shows all domains again. Plan usage always shows the workspace total.

This filter only changes the visible list. It does not pause domains or change alert delivery. Opening an alert that points to another domain clears the filter to reveal it. If groups cannot be loaded, watched domains stay available and you can retry loading groups; a failure does not mean there are no groups.

Frequently asked questions

Does MailSolid touch my DNS? No. It only reads it, and gives you the records so you paste them yourself.

Is there a score from 0 to 100? No. The verdict is the worst case in words, with the severity next to it.

Who gets the alerts about changes? Each member chooses their own. See Alerts and integrations.

Domain detail and transport (0.20)

Open a domain in Domains for its summary and latest change. You can watch it there and open DNS and diagnosis for the complete report, checks and tools. DMARC, MTA-STS and TLS tabs target that domain. Protection also has dedicated MTA-STS and TLS reception entries. Pending infrastructure remains explicit: preparing a policy does not publish DNS or certificates.