# How do I read the domain health card?

> What the Health tab on a mailbox checks (SPF, DKIM, DMARC, MX and blocklists), what pass, warn, fail and unknown mean, and how to fix each finding.

Source: https://warmerly.com/docs/help/domain-health-card

The domain health card checks the DNS records and blocklists that decide whether mailbox providers trust mail from your domain. Open it from **Accounts**, click a mailbox, then open the **Health** tab. Each check shows one of four states, and the card has one headline that sums them up. Only a failed check can turn it red: warn and information items never do.

## The four states

| State | Meaning |
| --- | --- |
| **Pass** | Checked and fine |
| **Warn** | Works, but there is something worth tightening. Not a failure |
| **Fail** | Something is missing or broken and it will hurt delivery |
| **Unknown** | Warmerly could not get an answer this time. This is not a pass and not a fail |

**Unknown is never shown as green.** If a DNS server was slow or a blocklist refused the query, the check says so and tries again automatically. Do not change your DNS because of an unknown result.

## What is checked

### SPF

Which servers may send as your domain. The card flags:

- **No SPF record** (fail).
- **More than one SPF record**, or a record with an unreadable part (fail). Providers ignore a broken SPF record completely.
- **SPF authorises the entire internet** (fail), meaning a record ending in `+all`.
- **Too many DNS lookups** (fail when over the limit of 10, warn when close to it).
- **No ending rule**, or an ending that takes no position on unknown senders (warn).
- **Soft fail** (`~all`) is shown as information only and does not lower the state.

### DKIM

Whether your mail is signed. The card flags **No DKIM signature found** (fail), **DKIM is still in test mode** (warn) and **a short key** (warn).

Warmerly finds DKIM by trying a list of common selector names. If your provider uses an unusual one, the card can say "none" for a domain that is signed. Enter your selector under **Settings, DKIM selector** and re-check. See [Setting up DKIM](https://warmerly.com/docs/guides/dkim) and [Troubleshooting](https://warmerly.com/docs/troubleshooting#dkim-shows-missing-but-the-record-exists).

### DMARC

The policy telling receivers what to do with forged mail. The card flags **No DMARC record** (fail), **DMARC is monitor-only** (warn, and very common, since `p=none` is the normal starting point) and a record with no policy (warn). Applying to only part of your mail, or not collecting reports, are shown as information. See [SPF & DMARC](https://warmerly.com/docs/guides/spf-dmarc).

### MX

Whether your domain can receive mail. **No MX records** is a fail: a domain that cannot receive replies looks suspicious, and warmup needs replies.

### Blocklists

Your domain and your mail server's IP address are checked against public spam blocklists. Warmerly checks six domain lists and ten IP lists. See [What if my domain or IP is on a blocklist?](https://warmerly.com/docs/help/blocklisted) for how to read a listing and get removed.

Blocklist results can be:

- **Clean on all N lists**: pass.
- **Clean on some lists, others did not answer**: warn, and the card says how many did not answer. It is honest that the picture is incomplete.
- **Your domain is blocklisted** or **Your mail server's IP is blocklisted**: fail.
- **This IP range isn't meant for sending**: warn. This is a statement about the IP range (typically a home or office connection), not a spam report against you.
- **Blocklist status unknown**: unknown.

## "Your mail server's IP" is not always yours

The IP check looks up the mail server your mailbox submits mail to. For a small or self-hosted mail server, that is the address your mail leaves from. For large providers such as Gmail or Microsoft 365, your mail leaves from a different pool, so Warmerly skips the IP check for them and says so, rather than reporting on an address you cannot control.

## Gmail, Outlook and other shared domains

If your mailbox address is on gmail.com, outlook.com or a similar consumer domain, the DNS records belong to the provider. The card shows a headline like "You're all set, gmail.com is managed by Gmail" instead of grading records you cannot change, and the domain itself is not checked against blocklists.

## Re-checking

Click **Re-check now** after you change a DNS record. DNS records are re-read immediately. Blocklists are checked at most about every six hours, so a re-check may reuse a recent blocklist result. DNS records are also re-checked automatically in the background, and blocklists about every six hours. DNS changes can take time to spread, so give a new record some minutes before concluding it has not worked.

## Alerts

Warmerly emails an alert when a **hard failure** appears in your records (a fail, not a warn), or when your domain or IP is newly blocklisted. Warnings such as DMARC monitor-only never trigger an alert.

## Common problems

**Everything is unknown on a new mailbox.** The first checks run shortly after you connect. Wait a few minutes and use **Re-check now**.

**A record shows fail but I just added it.** DNS has not spread yet, or the record was added under the wrong name. Compare it against [Email DNS records: the complete checklist](https://warmerly.com/docs/guides/dns-records).

**DMARC shows warn and I have a record.** Almost always `p=none`. It is safe to leave while you are starting out.

## Related

- [Email DNS records: the complete checklist](https://warmerly.com/docs/guides/dns-records)
- [Deliverability checklist before you launch](https://warmerly.com/docs/guides/deliverability-checklist)
- [Free deliverability tools](https://warmerly.com/docs/help/free-deliverability-tools) to check any domain without an account

## More in Deliverability

- [What do my mailbox's health score and status mean?](https://warmerly.com/docs/help/mailbox-health): How to read a mailbox page in Warmerly: the health score, the Healthy, Warming, Paused, Recovering and Needs…
- [How do inbox placement tests work?](https://warmerly.com/docs/help/placement-tests): What a Warmerly placement test sends, where to run it, that each test uses one of your monthly placement…
- [What if my domain or IP is on a blocklist?](https://warmerly.com/docs/help/blocklisted): What a blocklist listing means for cold email, how Warmerly checks for one, what a policy listing is, and…