What is a domain health check?
A domain health check reads the public DNS records that decide whether a domain's mail is trusted (SPF, DKIM, DMARC, MX, MTA-STS and TLS-RPT) and judges them together. They depend on each other: DMARC passes only when SPF or DKIM passes for an aligned domain, so reading one record at a time misses how they fail together.
Reading the result
The score runs from 0 to 100 and every point lost traces to a named finding, each with its severity and the fix. Parts of the score that cannot apply to a one-off scan are left out instead of counted as zero. Under the findings are the raw records, the mail provider and the DNS host.
Beat runs on the same engine, on a schedule, across all 41 checks and 25 blacklists. What it adds is asking again, noticing when an answer changes and telling you what to do about it.
Common domain health problems
No DMARC record, or p=none
Without enforcement, mail that claims your domain and fails authentication is still delivered, and Gmail and Yahoo require a DMARC record from bulk senders.
SPF over 10 lookups
The record exists and still fails, because receivers return permerror once the lookup limit is passed.
No DKIM key, or one under 2048 bits
Without DKIM, DMARC rests on SPF alone, and SPF alignment usually breaks when a message is forwarded.
No MTA-STS or TLS-RPT
Nothing tells senders to require TLS for your inbound mail, and nobody reports to you when a TLS connection fails.