Frequently asked questions

Often SPF, DKIM or DMARC are missing, or an entry is wrong. Gmail and Outlook filter emails without these entries more strictly. Blacklists can also play a part. The free check shows what is missing for your domain.

Yes, if your domain has no DMARC with p=quarantine or p=reject: then any server can send emails with your sender address, and many recipients accept them. DMARC only stops forgery of your exact domain – not look-alike domains or free addresses. So always confirm payment requests through a second channel.

So that before ordering you can calmly see what DomainRadar finds on your domain and whether it helps you day to day. You make no commitment; what happens after the trial is explained under «What happens after the 14-day trial?».

No. DomainRadar shows an overall grade, traffic lights and the most important next step in plain words. The technical details are there when you or your IT partner need them.

Possibly. If a subdomain still points to a deleted cloud service or SPF includes a domain that no longer exists, a third party may be able to claim that name again. The takeover watch reports such orphaned records with a severity and a ready-made suggestion of which record to remove. It only checks via DNS and never attempts a takeover itself.

DMARC is a record in your DNS. It tells mail servers what to do with emails that claim to come from your domain but fail the check: deliver them (p=none), put them in spam (p=quarantine) or reject them (p=reject). Mail providers send reports about this, which DomainRadar analyses.

Yes. Since May 2026, RFC 9989 (DMARC) and RFC 9990 (aggregate reports) replace the previous standard RFC 7489. DomainRadar also checks every DMARC record against RFC 9989: it points out removed tags such as pct, rf and ri, recommends np=reject, warns about psd=y and checks the values of np, t and psd. You get a ready-to-copy record following DMARCbis and see in the portal and the monthly report whether your domain is DMARCbis compliant. DomainRadar reads reports in the new format just like the old ones, and the free check shows the new notes as well. DomainRadar never changes your DNS: you add the recommendations yourself.

DomainRadar shows for each domain which mailbox providers sent reports in the last 30 days. If a large provider such as Google, Microsoft or Yahoo that used to report regularly sends no reports for longer (Google and Yahoo 72 hours, Microsoft 96 hours), you get an alert. The most common cause is a changed DMARC record without the DomainRadar address. Domains with little email traffic only get reports now and then; there is no alert for them, just a note. Only reports whose origin is confirmed by DKIM are counted. Many smaller mailbox providers send no reports at all.

No. DMARC reports contain no email content, only sending servers, counts and check results.

No. All checks are read-only; DomainRadar changes none of your settings. You only move to p=reject once the assistant rates it as safe.

For the DMARC analysis, one DNS record that we specify exactly. The other checks work without setup.

Raw reports are deleted after 30 days, analyses after 13 months; backups keep them for up to 30 more days. Who processes data on our behalf is listed on the “Sub-processors” page.

With the “Rejected spoofing” figure in the dashboard and monthly report. It shows how many emails that failed DMARC the receiving mail servers rejected or quarantined according to their DMARC aggregate reports – over 12 months and broken down by recipient. Only reports whose sender is confirmed by DKIM count; emails that were probably forwarded are shown separately as “unclear”. If your domain is still on p=none, the figure shows instead how many spoofed emails were delivered and leads to the p=reject assistant.

After every detected DMARC level change, the regression watch observes each service you have marked as legitimate for about 14 days from the first report after the change. It compares rejections before and after the step, only above a minimum volume, so that a few isolated cases do not trigger an alert. If they rise, you get an alert with the previous DMARC record as a way back and a gentler alternative: align the service with DKIM to your domain first. Without findings, the step counts as confirmed. DomainRadar does not change your DNS; it only recommends.

Yes. IT partners can also offer DomainRadar under their own name and manage it for you. More on the Resellers page.

The plan costs CHF 19 per domain per month, with all features and any number of domains. This is a final price: Not registered for VAT, no VAT is charged. With a yearly plan you get 1 month free: CHF 210 per domain per year. We invoice the monthly plan in arrears: at the start of each month for the past month, based on the number of domains in that month. We invoice the yearly plan once in advance for the whole subscription term; domains added during the term are invoiced once, pro rata until the end of the term. Every registered domain counts, including a parked domain that sends no email. Setup by us (all the way to full protection, p=reject) is available on request.

Many free offers focus on analysing DMARC reports, with limits on domains, email volume or history depending on the provider. DomainRadar also checks certificates and blacklists, warns you by email, guides you step by step to p=reject and sends a PDF report every month, for example for your insurer. If your IT partner already reads the reports regularly and your domain is already on p=reject, a free tool can be enough.

You test DomainRadar with all features for 14 days without a credit card. The trial ends on its own. Nothing is charged automatically and no plan is taken out; your data stays readable. You only get a plan if you expressly order it.

With a short email to info@domainradar.ch – no reason needed. The monthly plan is open-ended and can be cancelled at any time with 1 month’s notice, the yearly plan with the same notice to the end of the current subscription term (individual domains too); details are set out in the terms. You can export your data up to 30 days after the end of the contract; we delete it 30 days after the end of the contract.

Even additional domains that send no email can be misused for spoofed senders. A few DNS records state that the domain never sends: SPF “v=spf1 -all”, DMARC “p=reject” including subdomains and, if it receives no email either, a null MX. DomainRadar spots such domains in the reports, shows the records to copy and reports if email does turn up under the name. You or your IT partner set the records; DomainRadar never changes DNS. DomainRadar monitors these domains at the normal price per domain too.

The code states why the recipient rejected the email, for example missing sender authentication (SPF, DKIM, DMARC), a blocklist or a full mailbox. The free bounce decoder on this website explains such messages in plain words. The pasted text stays in your browser.

When all mail servers are listed in the policy, their certificates are valid, the TLS reports show no MTA-STS or certificate failures and the domain has run on testing for a while. DomainRadar checks these points, recommends the timing and lets you know when a domain stays on testing for a long time. You or your IT partner make the switch – DomainRadar never changes your DNS records.

No. If a name such as autodiscover points via CNAME to a service of your provider (e.g. Microsoft 365), the provider manages the certificate; it does not count towards the grade. A host found only via a common name and running no service does not count either. DomainRadar checks the matching port depending on the name (e.g. IMAP 993, mail submission 465 or 587), and your IT partner can set a service per host or choose “no service here”. The grade calculation shows what counts and what does not.