Monitor Settings
Example Data Table
| Domain | IPs | IP Hits | Domain Hits | Risk | Suggested action |
|---|---|---|---|---|---|
| example.com | 93.184.216.34 | 0/18 | 0/2 | 12/100 Minimal | Continue scheduled monitoring. |
| sample-mail.test | 203.0.113.55 | 2/18 | 0/2 | 66/100 High | Request delisting. Improve SPF, DMARC, and DKIM. |
| phishy-site.demo | 198.51.100.90 | 1/18 | 1/2 | 84/100 Critical | Pause campaigns. Investigate compromise and clean sources. |
Formula Used
The calculator produces a Risk Score (0–100) using three parts:
-
Listing score (0–80): weighted hit ratio across selected sources.
listingScore = round((listedWeight / totalWeight) × 80)
-
Hygiene score (0–15): missing SPF/DMARC/DKIM/MX adds risk if selected.
hygieneScore = round((1 − passRatio) × 15)
-
Latency score (0–5): slower DNS responses add up to 5 points.
latencyScore = min(5, round((avgMs − 800)/400))
risk = clamp(listingScore + hygieneScore + latencyScore, 0, 100)
How to Use This Calculator
- Enter one or more domains or subdomains.
- Select check mode and preferred sources.
- Enable hygiene checks for DNS authentication signals.
- Set your base interval and alert threshold.
- Run the monitor and open per-domain details.
- Export CSV or PDF for audits and tracking.
FAQs
1) What does “listed” mean here?
A selected source returned a positive result for your IP or domain. Listings may reduce inbox placement, block mail, or trigger reputation warnings on some systems.
2) Why do some domains skip IP checks?
If the domain has no A record, or resolves only to non-IPv4 addresses, IP-based DNSBL queries are skipped. Domain checks and hygiene signals still work.
3) Is a high risk score a confirmed compromise?
Not always. It means stronger negative signals. Verify with the specific list provider, check logs for unusual sending, and scan accounts for abuse or malware.
4) Why might results differ across networks?
DNS caching, resolver behavior, and blacklist query limits can vary. Run checks from the environment that sends mail or hosts your services for best alignment.
5) What should I do first if listed?
Pause questionable outbound traffic, fix authentication and security issues, then follow the delisting instructions for each provider. Keep timestamps, IPs, and evidence for support tickets.
6) How do SPF, DKIM, and DMARC help?
They reduce spoofing and improve identity consistency. They don’t remove listings directly, but missing records can increase risk and prolong reputation recovery.
7) Can I monitor subdomains separately?
Yes. Enter each subdomain on its own line. Subdomains may use different infrastructure and DNS records, leading to different reputation outcomes.
8) How often should I run checks?
Use longer intervals for low risk, and shorten checks as risk rises. The monitor suggests an interval based on the highest score in the current run.