Sample paid report
See the implementation brief before you buy
The free scan diagnoses the sender records. The paid report is built for the moment you need to make the DNS change safely: what to fix first, what record to add, where to add it, and how to verify it.
Example domain
example-saas.com
Repair recommended
Executive summary
Two sender-trust fixes should happen before the next campaign.
DKIM is the first implementation risk because the sending platform must generate the selector. SPF can be tightened after the active sender list is confirmed.
Authentication checks
SPF
WARNSoft fail policy
The domain authorizes Google Workspace and SendGrid, but the record still ends in ~all.
DKIM
FAILMissing SendGrid selector
The common s1 and s2 selectors were not found, so marketing email may not be signed.
DMARC
WARNMonitoring only
DMARC exists, but p=none means receivers are not told to quarantine or reject failed mail.
BIMI
WARNNot ready yet
BIMI should wait until DMARC reaches quarantine or reject.
MTA-STS
WARNOptional security gap
No MTA-STS policy was found for encrypted inbound transport.
DNS repair queue
Copy-paste records where safe
DKIM
s1._domainkey
This record must come from SendGrid because DKIM keys are provider-generated.
SPF
@
Use this only after confirming no other tools send from the domain.
DMARC
_dmarc
Move from monitoring to enforcement after legitimate mail passes SPF or DKIM.
Provider steps
Google Workspace
Admin Console > Apps > Gmail > Authenticate Email > generate or verify DKIM.
SendGrid
Settings > Sender Authentication > Domain Authentication > copy the CNAME/TXT records.
Cloudflare DNS
Website > DNS > Records > add each TXT or CNAME record, then wait for propagation.
What this does not do
InboxShield does not ask for registrar passwords, does not change DNS for you, and does not promise inbox placement. It gives you the sender-authentication repair plan and the verification steps.
Verification checklist
How you know the fix worked
Wait at least 15 minutes after DNS changes, then rerun the InboxShield scan.
Send a test message to Gmail and inspect Show original for SPF, DKIM, and DMARC pass states.
Keep DMARC reports on for one to two weeks before moving to stricter enforcement.
Document the final sender list so future marketing or billing tools do not break authentication.