~ digitalchk / docs / email-health-chk
Email Health Chk analyzes the public email posture of a domain: how it authenticates its mail, how its mail servers negotiate TLS, whether its addresses appear on blocklists, and where the gaps are. It runs as a WordPress plugin, publishes a front-end tool for your visitors, and emails each of them a written report.
What it is for. Two things at once. Your visitors get a straight answer about their own domain, and you get a qualified conversation starter, because someone who just learned their DMARC is in monitoring mode is a person with a problem you can solve.
Requirements
- WordPress 5.8 or newer
- PHP 7.4 or newer
- Outbound DNS resolution from the server, including TXT and MX lookups
- Outbound SMTP connections on port 25 for the mail server checks
The plugin works with none of the optional services below configured. You will get the full technical analysis; what you lose is the written narrative and the PDF.
What it checks
Every finding falls into one of five groups, and each carries a severity that drives how the report is ordered.
| Group | Checks |
|---|---|
| Authentication | SPF present and unique, SPF lookup count against the limit of ten, void lookups, include chains that do not resolve, include loops, DKIM detection, DMARC presence and policy, DMARC delegated by CNAME |
| Mail server | MX records, STARTTLS support, certificate validity and expiry, certificate hostname match, MTA-STS, TLS-RPT |
| Blocklists | The sending addresses checked against public DNS blocklists, with lists that refuse our queries reported as refused rather than as clean |
| DNS | DNSSEC, CAA records, BIMI |
| Web server | Whether the domain answers over HTTPS |
One design decision worth knowing. When a check cannot be completed, the plugin says so. It does not report a failed lookup as a clean result. This matters more than it sounds: a blocklist that refuses queries from public resolvers will answer “not listed” to a naive implementation, and the report would then tell your visitor they are fine when nothing was actually checked.
Attribution. The plugin shows a small “A tool by Digital Checkmark” line, with a link to digitalchk.com, under the analyzer, at the foot of every page of the PDF briefing and under every email it sends. It is part of the plugin and has no setting to turn it off. If a tool and a Leads Chk form share a page, the line shows once.
Setting it up
Anti-abuse Recommended
Under Settings, add your Cloudflare Turnstile site key and secret key. Turnstile stops automated abuse of the public tool. Without it, anyone can script your tool and consume your quotas on the services below.
Email verification Recommended
Under Verification, add a Reoon API key. This confirms an address can actually receive mail before the plugin generates and sends a report to it, which protects your sending reputation from bounces to invented addresses.
The written report Optional
Under Settings, choose an AI provider and add its key. The model receives the technical findings and writes the plain-language explanation and the ordered action plan. Without a key, the tool still produces the full analysis, just without the narrative. On models that support it, Thinking level trades speed for depth. Under Backup AI you can add a second AI service with a Chat Completions API that writes the report when the main provider fails or times out.
Every DNS record the model suggests is labeled as AI generated with an instruction to validate it before publishing. Leave that label in place.
PDF reports Optional
Reports are converted to PDF by Gotenberg, which you self-host. Set its URL under Settings. It normally runs as a container on the same machine, in which case the URL is http://127.0.0.1:3000.
If you cannot run Gotenberg, go to Email Reports and set the attachment format to HTML. The same document is attached as an .html file with no converter involved. Be aware that many mail gateways quarantine or strip HTML attachments, because they are a common phishing vector, so prefer PDF wherever you can run the converter.
Delivery
Under Email Reports, configure the SMTP server that sends the reports, along with the branding that appears on them: company name, tagline, logo, colors and cover layout.
Lead capture and retention
When a visitor asks for their report, the plugin can store the address as a lead along with the domain analyzed and a count of findings by severity. You will find these under Leads.
Two settings govern this:
- Enable lead capture. Turn it off and the verified address is used only to deliver the report and is then discarded. No lead is stored and no notification fires. Turnstile, the one-time code and the email verification still run, because those exist to prevent abuse rather than to collect anything.
- GDPR retention (days). Leads older than this are deleted automatically by a scheduled task. Set it to 0 to disable the purge, though we would not recommend that.
- Privacy requests. The plugin works with the WordPress privacy tools (Tools > Export Personal Data and Erase Personal Data): one request exports or deletes everything it keeps for an email address, including the reports sent.
If Leads Chk is installed, every address that asks for a briefing is also sent there, with tags and a consent record. What happens next (saved only, newsletter offered with a checkbox, or subscribed) and which list it goes to is decided in this plugin’s Integrations screen. Leads Chk can also place a newsletter form under the tool.
Languages
The plugin ships with Spanish translations and follows the site locale, including the language carried by the request when you run a multilingual site. The briefing itself, the on-screen report and the PDF are all produced in the language the visitor is reading.
If something does not work
No PDF arrives, but the analysis runs.
Check the Gotenberg URL and that the service answers. The plugin reports a conversion failure rather than sending an empty message.
The report is in the wrong language.
Confirm the site locale, and that your multilingual plugin is passing the language on front-end requests.
A blocklist check reports as refused.
That is expected when your server resolves through a public DNS resolver. Several blocklists decline queries from those, and the report says so rather than pretending the address is clean.
The tool loads but never submits.
Check that Turnstile keys are correct and that challenges.cloudflare.com is reachable from the visitor’s browser.
Getting help
Write to us through the support page. Include your plugin version, your WordPress and PHP versions, and the exact text of any error.