◇ DNS & email auth check
This check reads a domain's public A, AAAA, MX, NS, TXT and CAA records, then reviews email authentication: SPF syntax and its 10-DNS-lookup limit, the DMARC policy and reporting addresses, and 10 common DKIM selectors. Each problem comes with a fix. It is free and allows 20 checks an hour.
Every public DNS record for a domain, plus an SPF, DMARC and DKIM review: the settings that decide whether your email lands in the inbox or in spam, and whether someone else can send as you.
SPF
Which servers may send as you. We check there's exactly one record, the syntax, the 10-DNS-lookup limit across all nested includes, and whether it ends in -all or ~all.
DMARC
What receivers do with mail that fails SPF and DKIM. We read the policy (none, quarantine, reject), reporting addresses and pct, and fall back to the parent domain like receivers do.
DKIM, MX, CAA
Keys on common selectors (Google, Microsoft 365, Mailchimp ...), mail servers, null MX, and which certificate authorities may issue for the domain.
Get told when someone changes your DNS
Vigil's domain monitor snapshots your records and alerts on any change: a hijacked NS, a deleted SPF include, an MX pointing somewhere new. It also warns before the domain and its certificates expire.