DMARC policy: none, quarantine, or reject?
Understand DMARC p=none, p=quarantine and p=reject, how they differ, and how to move toward enforcement safely.
DMARC CheckerDomain health resources
Domain health guides
Practical explanations for DNS, SSL, HTTP security headers, and email-authentication decisions.
Guides
How to fix a missing SPF record
Learn how to investigate a missing SPF record, identify legitimate senders, and publish one safe SPF policy for your domain.
SPF Record CheckerWhat is a DKIM selector?
Understand what a DKIM selector is, where to find it, and how to validate one selector-specific DKIM DNS record safely.
DKIM CheckerHow to troubleshoot a DNS resolution failure
Troubleshoot DNS resolution failures by separating NXDOMAIN, SERVFAIL, delegation and propagation issues before changing records.
DNS Health CheckSSL certificate expiry checklist
Use a practical SSL certificate expiry checklist to review HTTPS reachability, certificate renewal ownership, DNS and post-change verification.
SSL Certificate CheckerEssential HTTP security headers
Learn what Content-Security-Policy, Strict-Transport-Security and X-Frame-Options do, and why header presence alone is not a security guarantee.
Security Headers CheckerA practical domain monitoring checklist
Use this domain monitoring checklist to review DNS, SSL, HTTPS, email authentication and configuration changes with clear ownership and follow-up.
Domain Health CheckHow SPF, DKIM, and DMARC work together
Understand how SPF, DKIM and DMARC work together, what each public DNS signal means, and how to prioritize email-authentication remediation.
Email Security CheckSPF too many DNS lookups: what it means and how to fix it
Why SPF fails with a permanent error after ten DNS lookups, how to count the lookups your record really triggers, and four ways to get back under the limit.
SPF Record CheckerGmail, Yahoo and Outlook sender requirements, in plain terms
What Google, Yahoo and Microsoft require from senders, which rules apply to every domain and which only to bulk senders, and how to check a domain against them.
Email Security CheckHow to read DMARC aggregate reports
What a DMARC aggregate report contains, how to read a record row, what the reports cannot tell you, and how to use them to find every system sending mail as your domain.
DMARC CheckerLet's Encrypt no longer emails you before a certificate expires
Let's Encrypt ended its certificate expiration notification emails in June 2025. What changed, why renewals still fail silently, and how to monitor certificate expiry yourself.
SSL Certificate CheckerSubdomain takeover and dangling DNS records
How a forgotten CNAME lets someone else serve content on your subdomain, which records are at risk, and a repeatable process to find and remove dangling DNS.
Domain Health CheckMonitoring client domains as an agency or MSP
What to monitor on client domains, how to turn silent failures into a recurring service, and how to report domain health to clients who do not read DNS.
Free Domain ScanHow to set up MTA-STS and TLS-RPT
A practical guide to MTA-STS and TLS-RPT: what they protect against, the DNS records and policy file to publish, how to move from testing to enforce, and the mistakes that stop inbound mail.
MTA-STS CheckerBIMI setup and requirements
What BIMI needs before a logo appears next to your emails: DMARC enforcement, an SVG Tiny PS logo, a mark certificate, the DNS record, and why a correct record can still show nothing.
BIMI Record CheckerCAA records explained
What a CAA record does, how certificate authorities look it up, the issue, issuewild and iodef tags with examples, and how to add one without breaking automatic certificate renewal.
CAA Record CheckerDNSSEC explained
What DNSSEC protects against, the records involved, how to enable it at your DNS provider and registrar, and the safe order of steps for changing providers without taking the domain offline.
DNSSEC CheckerWhat happens when a domain expires
The stages a domain goes through after its expiry date, what stops working at each one, how recovery gets slower and more expensive, and how to make sure a registration never lapses.
Domain Health CheckWhy your emails go to spam
A step-by-step way to find out why legitimate email lands in spam: authentication and alignment, sender reputation, complaints, list quality and content, and what DNS can and cannot fix.
Email Security CheckGuide review policy
CloudSpex authors and reviews these guides. We base them on public technical standards and provider documentation, record the latest review date on each guide, and update them when product behavior or underlying guidance changes.