Questions, problems, or a service the app should recognise but doesn't? Email steve.whittle@gmail.com.
Type a domain — example.com — and DNS Survey reads its public DNS records
and explains, in plain English, how that domain handles email: who hosts the mailboxes,
which outside services are allowed to send mail in its name, whether it is protected
against spoofing, and which SaaS products the domain has been verified with.
Everything it reports comes from public DNS records. It does not connect to mail servers, send email, or need any credentials.
A plain-English summary of the domain's email posture — mailbox host, SPF, DMARC and DKIM — with a green, amber or red marker for each. This is the part to read if you are not a DNS specialist.
Services permitted to send email as this domain. Entries tagged infrastructure are shared sending platforms such as SendGrid or Amazon SES: their presence proves mail is being sent, but not which application is behind it, because many products relay through the same platform.
Products the domain shows evidence of using, grouped by category. Evidence from MX or SPF records is strong. Evidence from a TXT verification token is weaker — it means the domain was verified with that service at some point, and those tokens are almost never cleaned up afterwards. Read a TXT match as "has an account", not "uses it today".
The raw records — SPF, DMARC, MX, NS, CNAME, A, TXT and DKIM — plus SPF lookup-count and DMARC policy warnings. Tap and hold to select and copy any value.
The domain publishes no MX records, so it isn't set up to receive email. That is normal for a domain used only for a website, or for one parked and unused.
DKIM keys live at unpredictable names chosen by whoever set them up, and there is no way to list them. The app checks a list of the selectors used by common providers, so a domain signing its mail with an unusual selector will show none. "No keys found" means "none at the names we checked", not "the domain doesn't sign its email".
Very likely correct at the time. Domain-verification records are added when a service is set up and are rarely removed when it is dropped, so they accumulate for years. This is why TXT-based matches are labelled as weaker evidence.
No, by design. The app stores nothing at all — no history, no cache, no settings. Each lookup exists only while you are looking at it. See the privacy policy.
The app looks up records through Google Public DNS over HTTPS. This message means that request failed — usually no internet connection, but some networks and countries block DNS-over-HTTPS. Try another network.
Each survey makes around thirty DNS queries. On a slow connection it can take a few seconds.
Email steve.whittle@gmail.com with the domain you looked up and what you expected to see. If the app identified a service incorrectly, or missed one you know is in use, the domain name alone is usually enough to investigate.