What MailAuth Doctor does
Check SPF, DKIM, DMARC and MTA-STS for any domain, read DMARC reports in your browser, and get an email when your records change.
Email authentication fails quietly. A sender added to SPF can push it past the 10-lookup limit and make every receiver reject it as a permanent error, a DMARC policy can sit at p=none for years while spoofers use your domain, and nobody notices until mail starts landing in spam. MailAuth Doctor reads your public DNS, explains each finding in plain English, and shows the exact fix.
The SPF evaluator follows RFC 7208 completely: includes, redirects, macros, IPv6, void lookups and the 10-lookup limit. It passes the openspf.org RFC 7208 test suite and agrees with an independent open-source checker on live domains. The DMARC report reader opens the XML files that Google, Microsoft and others send you, entirely in your browser, and tells you in words why each sender failed alignment.
Everything on the free plan runs in your browser and nothing about your domain is sent to us. Pro is $7 a month to watch up to 10 domains every day and get an email when a record changes or a provider edits its own SPF include.
Popular uses
Each opens MailAuth Doctor already set up for that job, with steps and answers for that case.
Free vs Pro
| Feature | Free $0 · no account | Pro $7/mo · 3 browsers |
|---|---|---|
| Full SPF check by RFC 7208: every include followed, the exact DNS lookup count out of 10, void lookups, and a per-include cost table | Included | Included |
| Test whether a given sending IP is allowed by a domain's SPF | Included | Included |
| DMARC record check, including whether reports sent to another domain are authorised | Included | Included |
| DKIM probe of about 55 well-known selector names, with key size | Included | Included |
| MTA-STS, TLS-RPT and BIMI record checks and a policy-file generator | Included | Included |
| Read DMARC aggregate reports (.xml, .gz, .zip) in your browser and see why each sender failed alignment | Included | Included |
| SPF builder with provider lookup costs measured from live DNS | Included | Included |
| Watch 1 domain weekly with email alerts | Included | Included |
| Watch up to 10 domains daily | — | Pro |
| Alerts when the lookup count crosses 8 or 10, a provider's include changes, a DKIM selector disappears or the DMARC policy weakens | — | Pro |
| Change history (the last 20 events per domain) | — | Pro |
Pro is $7/mo, billed monthly. Checkout and the licence key are handled by Dodo Payments (merchant of record). By buying you agree to the Terms and Privacy Policy.
Questions
Is MailAuth Doctor free?
Yes, with no account and no install. The free plan includes: Full SPF check by RFC 7208: every include followed, the exact DNS lookup count out of 10, void lookups, and a per-include cost table; Test whether a given sending IP is allowed by a domain's SPF; DMARC record check, including whether reports sent to another domain are authorised; DKIM probe of about 55 well-known selector names, with key size; and 4 more. Pro ($7/mo, billed monthly, cancel anytime) adds: Watch up to 10 domains daily; Alerts when the lookup count crosses 8 or 10, a provider's include changes, a DKIM selector disappears or the DMARC policy weakens; Change history (the last 20 events per domain).
Does MailAuth Doctor upload my data?
Only if you watch a domain. The checker, SPF builder and report reader run in your browser: DNS lookups go from your browser to Cloudflare and Google DNS-over-HTTPS, and report files are never uploaded. Watching stores the domain, hashes and text of its public DNS records, a short change log and, if you add one, your confirmed alert email. Delete a domain to remove it; unsubscribe removes the email. See the Privacy Policy for retention and deletion.
Do I need to install anything?
No. Open the page and start working. It works on desktop and mobile browsers.
How does the Pro licence work?
Pro is a monthly subscription handled by Dodo Payments (our merchant of record). You receive a licence key by email and paste it under "Have a key?" inside the tool. One key works on up to 3 browsers.
Does MailAuth Doctor send my domain or reports to your servers?
No. Domain checks run in your browser using public DNS-over-HTTPS from Cloudflare and Google, and DMARC report files are parsed locally. Only the optional domain watch stores anything.
How accurate is the SPF check?
The evaluator implements RFC 7208 and passes all 203 tests of the openspf.org RFC 7208 test suite. On live domains its DNS lookup counts matched an independent checker on 70 of 71 domains, and both flagged the one that differed as over the limit.
