Email Deliverability & Health Monitoring
Continuous DNS health auditing for your transactional and marketing sending domains. Automated verification of SPF, DMARC, DKIM, and MX records to satisfy Google and Yahoo sender requirements and protect your brand from domain spoofing.
Weighted across SPF, DMARC, DKIM, and MX
Plus manual on-demand audits with 60s cooldown
20-minute delayed recheck prevents transient blips
Up to 50 monitored domains per workspace
The 2024+ Deliverability Mandate
Major inbox providers like Google Workspace and Yahoo Mail enforce strict authentication standards for all domain senders. Domains sending transactional or bulk emails without aligned authentication face automated throttle rejections, spam placement, or outright delivery blocks.
Three Pillars Required for Delivery
- 1. SPF AlignmentPublish an authorized list of IP ranges and third-party SaaS senders without exceeding 10 lookups.
- 2. DKIM CryptographyCryptographically sign outbound messages with active, unrevoked public keys (minimum 2048-bit).
- 3. DMARC EnforcementPublish a policy instructing mailboxes to quarantine or reject unaligned messages, with reporting.
The 4 Diagnostic Pillars in Pingzo
SPF (Sender Policy Framework)
Weight: Up to 35 PointsEvaluates published TXT records starting with v=spf1. Audits qualifier enforcements and calculates total DNS lookups.
DMARC Policy
Weight: Up to 35 PointsQueries _dmarc.yourdomain.com with organizational apex fallback via the Public Suffix List (PSL).
DKIM (DomainKeys Identified Mail)
Weight: Up to 10 PointsProbes common provider selectors (Google, Microsoft 365, SendGrid, Postmark) alongside custom selectors configured in your workspace.
MX (Mail Exchanger)
Weight: Up to 20 PointsResolves mail exchangers and validates that target hostnames have active, routable A or AAAA records.
Step-by-Step Remediation Guides
When Pingzo flags an issue in your Email Health dashboard, follow these direct registrar instructions to resolve the root cause.
How to add a missing SPF record
If your domain has no published SPF record, receiving mail servers will distrust your outbound messages. To fix this, log in to your DNS registrar (Cloudflare, GoDaddy, Namecheap, Route 53) and add a single TXT record:
| Record Type | Name / Host | Value / Content | TTL |
|---|---|---|---|
| TXT | @ (or leave empty) | v=spf1 include:_spf.google.com ~all | Auto or 3600 |
- Google Workspace:
include:_spf.google.com - Microsoft 365:
include:spf.protection.outlook.com - SendGrid:
include:sendgrid.net - Postmark:
include:spf.mtasv.net
• Cloudflare: Ensure the record is set to "DNS only" (grey cloud). Proxied records will break SPF.
• AWS Route 53: TXT record values must be enclosed in quotation marks: "v=spf1 include:_spf.google.com ~all".
• GoDaddy / Namecheap: Use @ as the Host field.
How to merge multiple SPF records
RFC 7208 strictly prohibits publishing more than one SPF TXT record. If you publish two records, receiving servers fail the check with a PermError. You must merge them into a single record.
How to publish a DMARC policy
DMARC must be published as a TXT record specifically on the _dmarc host:
| Record Type | Host / Name | Value | TTL |
|---|---|---|---|
| TXT | _dmarc | v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com; pct=100 | Auto |
We recommend starting with p=quarantine or p=rejectto gain maximum deliverability points and full spoofing protection.
How to monitor custom DKIM selectors
Unlike SPF and DMARC which use fixed hostnames, DKIM uses unique selectors specified by your email provider (e.g., google._domainkey.domain.com ork1._domainkey.domain.com).
• Google Workspace: Google Admin Console → Apps → Google Workspace → Gmail → Authenticate email (defaults to google).
• Microsoft 365: Defender Security Portal → Email authentication → DKIM (uses selector1 and selector2).
• Postmark / SendGrid / Resend: Look under your provider domain settings for the CNAME prefix before ._domainkey.
In Pingzo's dashboard, click + Add Selector to add up to 10 custom selectors per domain. Pingzo will automatically monitor key validity and warn if keys are revoked or rotated unexpectedly.
Defensive Protection for Parked Domains
If your organization owns defensive brand domains that never send or receive email, attackers can still impersonate them. Pingzo intelligently recognizes parked domains when configured defensively and awards a 95/100 health score without penalizing you for lacking DKIM:
v=spf1 -allRejects all sending serversv=DMARC1; p=reject;Enforces instant rejection0 .Explicitly refuses inbound mailZero False-Alarm Alerting Architecture
2-Stage Verification Cycle
DNS propagation delays and transient upstream nameserver timeouts frequently cause false alarms in legacy tools. When Pingzo detects an authentication failure, it schedules an automated confirmation check 20 minutes later via QStash. Alerts are dispatched only if the second consecutive check confirms the breakage.
State Claims & Recovery Alerts
State transitions are managed atomically in PostgreSQL. Once an incident alert is sent, Pingzo halts duplicate notices. When your DNS fix propagates and the score returns above healthy thresholds, Pingzo immediately sends a single EMAIL_AUTH_RECOVERED notification with verification details.
Plan Quotas & Limits
| Plan | Monitored Domains | Automated Cadence | Multi-Channel Alerts | Custom DKIM Selectors |
|---|---|---|---|---|
| Free | Preview only | Manual (via Public Tools) | None | None |
| Starter | 3 Domains | Daily 09:00 UTC | WhatsApp, Slack, Discord, Telegram, Email | Up to 10 / domain |
| Pro | 10 Domains | Daily 09:00 UTC | WhatsApp, Slack, Discord, Telegram, Email | Up to 10 / domain |
| Agency | 50 Domains | Daily 09:00 UTC | WhatsApp, Slack, Discord, Telegram, Email | Up to 10 / domain |
Need a quick one-off lookup?
Use Pingzo's suite of free public diagnostic tools without creating an account or logging in:
Frequently Asked Questions
Why does Pingzo flag multiple SPF records as a critical issue?
RFC 7208 strictly specifies that a domain must publish at most one SPF TXT record. If receiving mail servers detect multiple SPF records, they evaluate the check as PermError (Permanent Error) and often mark all outbound emails as unauthenticated or deliver them to the recipient spam folder.
How does Pingzo avoid false positive alerts on email domain checks?
Pingzo implements a two-stage verification cycle. When a DNS failure is detected, Pingzo does not immediately dispatch an alert. It schedules a delayed recheck 20 minutes later via Upstash QStash. Only if the failure persists across consecutive evaluations is an incident alert dispatched.
What is the RFC 10 DNS lookup limit for SPF records?
To prevent Denial of Service (DoS) attacks on DNS infrastructure, RFC 7208 caps the total number of DNS-querying mechanisms (include, a, mx, ptr, exists, redirect) in an SPF record at 10. Exceeding 10 lookups causes receiving servers to abort evaluation with an SPF PermError.
How does Pingzo score parked or non-sending domains?
Domains configured strictly with defensive SPF records (v=spf1 -all) and RFC 7505 Null MX records (0 .) are automatically identified as non-sending parked domains. Pingzo awards full points for DKIM (marked as Not Applicable) and calculates a healthy 95/100 score without false warnings.