DNS cleanup
Find unused SPF senders and DKIM keys in your own reports.
Check your SPF senders and DKIM keys against 90 days of DMARC reports. See which are still in use, and review the evidence before you remove anything.
- Read from your reports
- A verdict per include and selector
- Business plan and up
Which SPF senders are still sending
SPF stops at 10 DNS lookups. We check each mechanism against your reports and show the evidence for keeping or removing it.
View full screenshot View full screenshot
Watch the lookup budget
The meter shows how many of SPF's 10 DNS lookups the record uses.
Review each include
Keep the senders still in use and inspect the include marked Can remove.
A verdict per mechanism
Every include, ip4, ip6,
a and mx term gets keep, review or
remove. Keep means addresses behind it sent mail that passed in the last
90 days. Remove means nothing behind it sent anything.
The lookup count and which include to drop
We count your lookups against the limit of 10. We show you which include to drop first, based on its lookup cost and 90 days without mail.
Proof behind every keep
The busiest addresses that matched each term, each one a link into your reports, so a keep verdict points at real senders you can name.
Review means we couldn't tell
Sometimes we can't check a term. The include points at names we don't look up, the lookup stopped partway, or your reports don't go back 90 days yet. The row says which one it is.
Which selectors still sign your mail
Nothing in DNS lists a domain's DKIM selectors. Signing keys builds the list from your reports and checks every key against live DNS.
View full screenshot View full screenshot
Find the selectors in use
See which selectors receivers saw signing your mail in the last 90 days.
Check the key in DNS
Review the current key and the keep or remove verdict before you change your records.
Every selector, found from your reports
Every selector a receiver saw sign your mail in the last 90 days, plus the common names providers use, checked in DNS one by one.
Every key checked in DNS
The page lists the selector that stopped resolving, the key published empty, and the RSA key under 2048 bits that should be rotated, with the provider that issued it.
Old selectors after a key rotation
Rotate keys and the old selector keeps its DNS record, unused. The page marks a selector as retired once your mail stops signing with it.
Fix now, before anything else
A selector your mail signs with today whose key is gone from DNS is the one finding that costs you delivery this week. It sits at the top, on its own.
Test the change, then publish it
Paste the record you're about to publish into the free SPF change pre-flight. We show every address range that would stop being authorized, the include each one came from, and the new lookup count. With hosted SPF, you add and remove senders from the domain's page. We keep the record flat.
Plans
Part of the Business plan and up
DNS cleanup includes the Monday digest, same-day alerts and sender evidence. Try every feature of the Business plan for 30 days, no card.
Business
$49 /month
10 domains
Portfolio
$79 /month
25 domains
Works alongside
Where to go next
FAQ
Questions people ask first
Will the cleanup remove senders or keys for me?
No. We show you which senders and keys are unused. You remove them yourself, in your own DNS or on the hosted SPF page. You'll see the change in the record history the next day.
How far back does it look?
90 days of your domain's reports. A sender that mails less often than that, such as a quarterly invoice run, can come back as remove. Before you delete an include, make sure it isn't one of those.
What does review mean?
It means we couldn't tell. Usually the include points at names we don't look up, the lookup stopped partway, or your reports don't go back 90 days yet. Each review row says which one it is. If your reports are too new, wait. For the other two, check the include yourself.
What counts as a weak DKIM key?
An RSA key shorter than 2048 bits. We show you the selector and the provider that issued the key. Follow that provider's steps to replace it.
Can it find selectors that are not on my reports?
Some of them. We try the common selector names providers use and check each one in DNS. If you use a custom selector name and no report has listed it yet, we can't find it, because DNS has no way to list a domain's selectors.
What if I'm on the free plan?
On the free plan, we check your SPF and DKIM records every day and keep a history of changes. To see which senders and keys you can remove, you need the Business plan or the Portfolio plan. You can try every feature of the Business plan free for 30 days.
What does it cost?
It's part of the Business plan and up. The Business plan is $49 a month for 10 domains and the Portfolio plan is $79 for 25. Try every feature of the Business plan free for 30 days, no card needed.
Read the verdicts before you touch the record
Add the domain, let the reports arrive, and both checks fill in over the first weeks. The first Monday digest already lists the sender to look at.
First domain free · 30 days on the Business plan · No card
- Keep, review or remove on every SPF mechanism
- The lookup count and the include to drop first
- Every DKIM selector, checked against live DNS
- Weak and empty keys named, with the issuer