Frequently asked questions

DKIM keys live under a freely chosen name, the selector. Selectors cannot be enumerated from outside — they can only be guessed. We try the common ones.

If none turns up, we say so as a note, not as a problem: we simply do not know, and marking a domain down would be a claim we cannot support. Only a real message from you gives certainty — in the message header, the DKIM-Signature line contains s=, and that is your selector.

What counts for deliverability is the PTR record of the server that SENDS your mail. From outside, however, only the addresses from your MX record are visible — that is, the receiving side.

With a self-hosted mail server that is the same machine and the finding applies. If you send by a different route than you receive — through a newsletter tool or a smarthost, say — then our finding says nothing about that route's PTR.

Whether your server actually accepts incoming connections encrypted, and whether its certificate is valid, is not currently checked. That would need a real SMTP connection on port 25, which is not possible from the platform mailampel runs on. It is planned for a later version.

DNS answers are cached. After a change it takes anywhere from minutes to hours, depending on your zone's TTL, until servers worldwide see the new state. Our report shows what the resolver returns at that moment.

Usually between five minutes and an hour, depending on the TTL of your DNS records. For freshly registered domains it can take longer. Just check again later.

Because SPF, DKIM and DMARC only answer whether a message is genuine — not whether it is wanted.

Delivery also depends on the reputation of your sending IP address, how your recipients behave, the content, and whether you appear on a blocklist. Clean records are the entry ticket, not a guarantee.

Yes. Only public DNS records are read — the same ones every mail server queries anyway. That is neither an intrusion nor an access attempt.

Useful, for instance, to see how a prospective partner is set up before working with them.

No. There is no history and no analysis. Once the report has been produced, the input no longer exists.

One single thing is counted: how many checks have been made in total. That is a bare number growing by one — no domain, no IP address, no timestamp. It shows that the tool is being used, and nothing else.

The one exception arises when you have the report sent to you by email: for that we store your address, the checked domain and the result — otherwise we could neither send the mail nor prove the confirmation. Your IP address is not stored even then.

Details are in the privacy notice.

Below every result you can have the report sent to you by email — to file away or forward to your IT provider. You first receive a confirmation email; only after you click the button in it do we run a fresh check of the domain and send the report. That way nobody can flood other people's mailboxes with reports.

The confirmation link is valid for 24 hours and works exactly once. If you do not confirm, the request is deleted automatically. Mail is sent from our dedicated sending domain send.mailampel.com — replies still reach us.

Yes, in three ways: as a PDF report with a cover header, an overview and page numbers, as a text file to attach — or simply pass on the address from your address bar. After a check it contains the domain, and whoever opens it sees the same report.

The PDF is produced in your browser, not on our server. The report about your domain never leaves your device in the first place.

The check: nothing, permanently. No account, no registration, no paywall — the report by email is free as well.

Ongoing monitoring has a free entry (first domain free forever) and costs €5 per month and domain from the second domain on — €50 per year with yearly billing, i.e. two months free. Beyond that we earn from users who ask us to fix the findings for them.

Many people now have a language model explain the work to them and get general answers, because they supply neither their findings nor their environment. The generated brief contains both, together with the instruction to use the DNS values from the report unchanged rather than inventing its own.

Two cautions: never put passwords or keys into an AI tool, and check every DNS record it proposes against the values in this report before you publish it. Language models occasionally invent such values very convincingly.

The prompt contains no IP addresses, email addresses or names, and your domain is replaced by the placeholder ihre-domain.example. What remains is the finding — plus, for the domain check, the public DNS records, and for the header check, the plain-language findings.

mailampel itself sends nothing to an AI — you copy the text and decide where it goes. What the AI tool you choose does with your input is governed by its provider; whether it is permissible for your organisation is something you assess as with any other service.

The spam score is the verdict of the recipient's spam filter, usually SpamAssassin. It adds points for anomalies — missing or unaligned authentication, poor sender reputation, suspicious content features, blocklist hits — and subtracts points for trust signals. Below 0 is very clean, from 3 it becomes noticeable, from 5 the message counts as spam.

At Microsoft 365 the counterpart is SCL (Spam Confidence Level): −1 trusted, 0–1 unremarkable, 2–4 borderline, 5–6 spam, 9 certain spam. In both cases sender authentication (SPF, DKIM, DMARC) is the strongest lever: once it is clean, the value usually drops by itself.

Yes, as an add-in. A task pane in Outlook reads the headers of the open message and shows the same analysis as the /en/header page — verdict, findings, delivery path and the reply template, which opens as a reply with one click. Pinned, the pane re-analyses every message you click. The headers stay in Outlook; nothing is sent to mailampel.

Install it yourself (Microsoft 365 or Exchange Online): save the manifest file via “Download manifest” on the header check page (address: www.mailampel.com/outlook/manifest.xml). Then, in Outlook on the web, open aka.ms/olksideload → “My add-ins” → “Custom add-ins” → “Add a custom add-in” → “Add from file” and pick the file. The add-in then also appears in desktop Outlook and the new Outlook for the same mailbox.

For a whole company: the administrator enters the manifest address in the Microsoft 365 admin center under Settings → Integrated apps → “Upload custom apps” and assigns the add-in to users or groups. On on-premises Exchange the pane shows a paste field, because older servers do not hand message headers to add-ins.