Skip to content
Outbox Pulse

Sending-domain health

See the moment a sending domain stops authenticating.

Outbox Pulse checks SPF, DKIM, DMARC, MX, BIMI, MTA-STS, and public blacklists on a schedule. When a record breaks, you get the change to publish and the click-path for the provider you actually use.

Monitor a domainOpen the demo

news.harbor.co

Example report

  • SPFFail12 lookups, over the limit of 10
  • DKIMFailNo key at selector1 or selector2
  • DMARCWarningp=none, spoofing is not rejected
  • MXPass2 hosts
  • DNSBLFail203.0.113.44 on SpamCop

What gets checked

SPF

Lookup count, including nested includes, against the limit of 10.

DKIM

Common selectors plus any you add. Weak and revoked keys are called out.

DMARC

Policy, rua, partial rollout, and a subdomain policy that undoes the parent.

MX

Mail exchangers, including a null MX that refuses inbound mail.

BIMI

Logo record, and whether DMARC is strict enough for it to show.

MTA-STS

The TXT id and the HTTPS policy file, when it can be fetched safely.

TLS-RPT

Where senders should report TLS failures.

DNSBL

The domain and the sending IPs, kept as history.

A fix, not a status code.

Each result is pass, warning, fail, or error, with a sentence a teammate can act on. Tips are specific to Google Workspace, Microsoft 365, Zoho, Amazon SES, Postmark, SendGrid, and Mailgun. If you send through more than one, select all of them and the expected SPF includes are checked together.

  • Google Workspace
  • Microsoft 365
  • Zoho Mail
  • Amazon SES
  • Postmark
  • SendGrid
  • Mailgun

“SPF needs 12 DNS lookups. The limit is 10. Flatten an unused include before the next campaign, or receivers will permerror mail that is otherwise legitimate.”

Example of the language on a domain report. Not a live lookup.

Lifetime tiers, enforced in the product

Codes stack. One code is Tier 1, two codes are Tier 2, three or more are Tier 3. AppSumo checkout is not connected yet. You can redeem a code inside the app, and a new workspace starts on the free cap.

Tier 1

A small team and a handful of sending domains.

  • 3 domains
  • 10 mailboxes
  • 20 placement tests / month
  • 2 seats
  • Blacklists every 24 hours

Tier 2

Several brands or clients, checked twice a day for listings.

  • 10 domains
  • 50 mailboxes
  • 100 placement tests / month
  • 5 seats
  • Blacklists every 12 hours

Tier 3

An agency or a mail-heavy company. Seats are not capped.

  • 30 domains
  • 200 mailboxes
  • 400 placement tests / month
  • Unlimited seats
  • Blacklists every 6 hours

Placement tests count against the monthly cap. DMARC aggregate reports use the rua address on each domain.

Questions worth answering first

Do you send mail for us?

No. The product watches the domains you already send from, regardless of provider.

What happens when a record changes?

Email, a Slack incoming webhook, and a generic JSON webhook. A weekly digest goes out on Monday.

Where do alert emails go if Resend is not configured?

They are stored on the Alerts page and written to the server log. Nothing is sent to a third party.