Changelog: what’s new in DomainRadar
New features and important changes, newest first. Anything that is only prepared and not yet switched on is stated explicitly as such.
· Free PHP check for PHP2Shell
- New free tool “Check PHP version”: shows which PHP version a website reveals, whether it is still supported and whether the PHP2Shell fix of 21 Oct 2026 is included. Without a visible version: minimum version from WordPress, plugins and themes.
- Public pages only, robots.txt respected, strict limits against abuse, no storage of domain or result.
· DMARCbis, rejected spoofing, regression watch and new guides
- Takeover watch: the new check area «Orphaned records» reports subdomains pointing to deleted cloud services and third-party domains in SPF, DMARC, MTA-STS or BIMI that may be free to register – with severity, explanation, copyable fix and alert. DNS only, never a takeover attempt.
- Report coverage: an overview per domain of which mailbox providers send DMARC reports (30 days, per day), an alert when a large provider that used to report regularly goes silent, and a line in the monthly report. Domains with little traffic get an explanation instead of an alert.
- DMARCbis (RFC 9989/9990): every DMARC record is also checked against the new standard – notes on pct, rf and ri, np=reject recommended, a warning for psd=y, “DMARCbis compliant” badge in the portal and the monthly report.
- Ready-to-copy record following DMARCbis and a transition record (“bridge”) with pct and t=y; the rollout assistant offers the Classic, Bridge and DMARCbis ladders.
- DMARC reports in the new format are read like the old ones; the free check shows the new notes too. New guide “DMARCbis: what changes”.
- New “Rejected spoofing” figure in the customer portal, dashboard and monthly report: emails that failed DMARC and that receiving mail servers rejected or quarantined according to their DMARC aggregate reports – with a 12-month history, a breakdown by recipient and unclear cases (probably forwarding) shown separately. On p=none, it shows how many spoofed emails were delivered.
- New regression watch: after every DMARC policy change, DomainRadar compares rejections before and after the step for each legitimate service for about 14 days and reports anomalies with a way back and a gentler alternative. DNS changes remain up to you.
- API v1: new alert type policy_rueckfall and new field wachfenster in GET /api/v1/domains/:id. Clients should tolerate unknown fields and alert types.
- New “Mailbox provider requirements” overview: for each domain, one light shows whether authentication (SPF, DKIM, DMARC, alignment) meets the rules of Google, Microsoft, Yahoo, Apple and Bluewin, a second how many of your emails pass DMARC there – also in the monthly report and via API v1. No guarantee of delivery.
- New free tool: paste a bounce message and find out what the error code probably means and what to do. The analysis runs only in the browser; nothing is transmitted or stored.
- In the portal it is also linked to the status of your own sender domain, including in the customer portal.
- Pricing page: price, scope, trial, term, cancellation and payment at a glance.
- Three new guides: emails sent in your name, emails that do not arrive, and checking blacklists.
- Page titles in everyday language; the Features and FAQ pages link to matching guides.
- Domains that never send according to DMARC reports are spotted; a person always confirms the classification.
- Ready-made records to copy or as a zone snippet: null MX, SPF -all, DMARC reject with sp and np, optional DKIM revocation.
- Notice if email does turn up under a confirmed domain; defensive package for typo variants that are probably free.
- MTA-STS enforce pre-check: an eight-point checklist per domain, the recommendation «ready for enforce», a notice after a long testing phase and an alert when, on enforce, a mail server is no longer listed in the policy or the id stays the same after a change.
· New website for non-specialists
- Home page in everyday language, with the free check at the top and a traffic-light verdict on the result.
- New “About us” page: who is behind DomainRadar and why it was built.
- Menu on mobile; the free check now also works reliably on iPhones.
· Better-looking emails and more blocklists
- All DomainRadar emails also come in a calm HTML version with the sender’s logo; the plain text remains.
- Closing email on the last day of the trial, with a summary and the pre-filled contract as a PDF.
- Many more blocklists, including domain lists, weighted by importance and with a removal link.
- DMARC and TLS reports only count as fine once the reports also reach DomainRadar.
- If a mail server rejects the check connection, the status reads “not checked” instead of “unreachable”.
- Trial sign-up via a form on the website prepared (not yet switched on).
· One plan and a trial with short reports
- One plan with all features, billed per domain with no domain limit; one month free with the annual plan.
- Free trial with short reports by email: first report, interim and final report, notices on critical changes; unsubscribe at any time.
- PDF report for every monitored domain, in the reseller portal and the customer portal.
- Domain status in colour: green, amber, red or grey.
- The risk scan also checks blocklists and can be refreshed with “Check again”.
· Easier setup
- The DMARC report address is created automatically with the customer; the DNS suggestions show the complete record right away.
- Resellers sign in with their own Microsoft account and assign roles by group or person.
- Portals and PDF reports in the style of the website, notes tucked behind an info icon.
- Free domain check on the website with a grade, clear findings and DKIM display.
· Custom reports and emails
- Report builder: custom template for the monthly report, with a live preview matching the PDF.
- Report, alert and invitation emails can be customised; compare, export and import templates.
- Switch between light and dark display with one button.
- Templates for data protection documents (DPA, sub-processors, data location, export and deletion).
· Report origin and risk scan
- The origin of incoming DMARC reports is verified via DKIM signature.
- Risk scan for a domain covering subdomains, certificates and blocklists, also available as a PDF.
- Trend and change versus the previous period in the overview.
- Automatic sign-out after 15 minutes of inactivity in the admin areas.
- Language, logo and colours take effect immediately, without reloading the page.
· Data protection and security
- Data access request per customer as a file (FADP/GDPR).
- Read-only access for end customers in a dedicated portal.
- Re-authentication before sensitive actions (step-up).
- Sending via your own connected Microsoft 365 mailbox prepared (not yet switched on).
· Senders, lookalike domains and four languages
- Sender inventory: which services send email in your domain’s name.
- Detection of similarly spelled domains (lookalikes) that could be used for fraud.
- Warnings via webhook to a destination of your choice.
- Interface in German, French, Italian and English.
- Self-registration with trial prepared (not yet switched on).
· First release
- Sign-in via Microsoft Entra ID, strict tenant separation, immutable audit log.
- Checks for SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI with clear recommendations.
- Monitor certificates (HTTPS and mail servers), blacklists and subdomains.
- Receipt and analysis of DMARC reports, alerts and a wizard for the path to p=reject.
- Monthly report as PDF and CSV, security score per domain, read-only API.
- Onboarding wizard for new domains.