# AstraVerify

> Domain trust: email and AI discovery. AstraVerify is a free domain checker for founders, marketing owners, IT admins and the agencies that manage many domains. Enter a domain and it fetches your site as Googlebot, Bingbot, OAI-SearchBot, PerplexityBot, ClaudeBot and GPTBot to see what each one actually receives, checks the files and tags those crawlers read (robots.txt, sitemap, redirects, page metadata, structured data, llms.txt), and reads the public DNS records that decide whether mail from the domain is trusted (MX, SPF, DKIM, DMARC). You get a Discoverability score, an Email Security score, and the exact record, file or tag to publish for every finding.

AstraVerify is a free web tool at https://astraverify.com. Enter a domain to get two scores out of 100, Email Security and Discoverability, with the exact record, file or tag to fix for each finding.

## Discoverability score
- Crawl access (25 points): robots.txt is readable and does not block search, answer-engine or AI-training crawlers, and the edge (CDN, firewall) actually serves the page to Googlebot, Bingbot, OAI-SearchBot, PerplexityBot, ClaudeBot and GPTBot.
- Site plumbing (20 points): Valid HTTPS, http and www redirecting permanently to one canonical host, no noindex on the root page, a valid sitemap declared with an absolute URL, lastmod dates and real 404s.
- Page metadata (20 points): Title and description at search-result length, exactly one H1, an absolute canonical link, Open Graph and Twitter tags, and a 1200×630 preview image that loads.
- Structured data (20 points): JSON-LD that parses and names the Organization, the WebSite and the type of thing the site offers, with BreadcrumbList on inner pages.
- Answer-engine readiness (15 points): An llms.txt file, an opening paragraph that defines the brand, question-form headings with direct answers, enough real text, and a declared language.

## Email Security score
- MX records (25 points): Confirms the domain can receive email and identifies the mail provider (Google Workspace, Microsoft 365, and others).
- SPF (25 points): Verifies a valid v=spf1 record, the servers it authorises, and whether it ends in -all (reject) or ~all (soft fail).
- DKIM (20 points): Finds published signing keys across common selectors and checks key strength; a live email can confirm the selector in use.
- DMARC (30 points): Checks the policy (none, quarantine, reject), alignment mode and reporting addresses, which together decide whether spoofed mail is blocked.

## How it works
1. Enter a domain: Type a domain you own or work with. No account needed.
2. Get two scores in seconds: Email results appear first because DNS answers instantly; the discoverability scan fetches robots.txt, your sitemap, the root page and a few inner pages at the same time, and requests the page as each named crawler.
3. Fix what matters: Each recommendation says what it costs you and gives the exact DNS record, file or HTML tag to publish, then a Verify button re-checks that one item.

## FAQ
- What is SPF? SPF (Sender Policy Framework) is a DNS TXT record that lists which mail servers are allowed to send email for your domain. Receivers check the sending server against it. A record ending in -all tells receivers to reject anything else; ~all only marks it as suspicious.
- What is DKIM? DKIM (DomainKeys Identified Mail) adds a digital signature to each outgoing message using a private key. The matching public key is published in DNS under a selector, such as google._domainkey.example.com. Receivers use it to verify the message was not altered and really came from your domain.
- What is DMARC? DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS record that tells receivers what to do when a message fails SPF and DKIM alignment: nothing (p=none), send it to spam (p=quarantine) or reject it (p=reject). It also lets you receive reports about who is sending mail as your domain.
- Why does my domain score less than 100? Points are awarded per record: MX 25, SPF 25, DKIM 20 and DMARC 30. Missing records score zero, and weak settings such as SPF ~all, DMARC p=none or a 1024-bit DKIM key cost points. The recommendations list shows exactly which change would raise the score.
- Why can DKIM not always be found from DNS alone? DKIM keys live under a selector name that is not listed anywhere in DNS. AstraVerify checks around 80 common selectors used by Google, Microsoft, and popular email services. Providers such as Amazon SES or Postmark use random selectors, so the tool also lets you send one email from your domain to read the real selector and confirm that outgoing mail is signed.
- What does the Discoverability score measure? Whether search engines and AI answer engines can crawl, read and quote the site: robots.txt rules and real crawler access at the edge (25 points), site plumbing such as HTTPS, one canonical host, sitemap and 404 handling (20), page metadata (20), structured data (20) and answer-engine readiness including llms.txt and a definitional first paragraph (15). It reads the root page and up to four pages from the sitemap; it does not measure keywords, rankings or backlinks.
- Why does blocking AI crawlers lower the score? A site that GPTBot, ClaudeBot, PerplexityBot or OAI-SearchBot cannot read is not quoted in ChatGPT, Claude or Perplexity answers and is not described from its own words in future models. Blocking them is a legitimate choice, and the score simply reflects the consequence: blocking search crawlers is critical, blocking answer-engine crawlers is important, blocking training-only crawlers is a recommendation.
- Does AstraVerify crawl my site? Only when someone enters your domain and presses Scan: about 14 to 18 requests for robots.txt, the sitemap, the root page, up to four inner pages, llms.txt, the preview image and one deliberately missing URL, finished in a few seconds and cached for 15 minutes. Opening a result link never triggers a fetch. The bot identifies itself as AstraVerifyBot and honours a Disallow rule for that name.
- Is AstraVerify free? Yes. Both scans, the scores, the recommendations and the emailed report are free, with no sign-up. Two things are paid: having the fixes done for you (fixed-price packages per domain) and monitoring, which rescans a domain weekly, keeps the history and emails you when something changes (14-day free trial, then monthly per domain). Monitoring also reads your DMARC reports: we issue you a reporting address, and every mailbox provider your mail reaches — Gmail, Microsoft, Yahoo, Apple and the rest — sends its daily report there for us to parse, so you can see every service sending as your domain and whether each one authenticates.
- What does processing my DMARC reports actually give me? A list of who is sending as your domain, which the scan cannot tell you. The scan reads your DNS; DMARC reports come from the receivers themselves. Every mailbox provider your mail reaches — Gmail, Microsoft, Yahoo, Apple, Fastmail and anyone else running DMARC — sends a daily XML report to the address in your record, from any provider whose users you email. We give you an address of your own, parse what arrives, and show each sending service with whether SPF and DKIM aligned for it. That is how you find the invoicing tool or newsletter nobody remembered, and how you know enforcing is safe before you move to p=reject rather than after.
- Can you fix it for me? Yes. Under the recommendations, choose Request a fix. A request is free and answered within one business day; a paid package covers the listed items for one domain, done directly with access you grant or as exact instructions to whoever manages your DNS and site, and verified by rescan.

## Pages
- https://astraverify.com/
- https://astraverify.com/guides
- https://astraverify.com/bot
- https://astraverify.com/connect
- https://astraverify.com/pricing
- https://astraverify.com/state-of-domain-trust
- https://astraverify.com/setup
- https://astraverify.com/terms
- https://astraverify.com/privacy

## Guides
- [What is SPF? Sender Policy Framework explained](https://astraverify.com/what-is-spf): SPF is a DNS TXT record listing the servers allowed to send email for your domain. Learn the syntax, -all vs ~all, the 10-lookup limit and common SPF mistakes.
- [What is DKIM? DomainKeys Identified Mail explained](https://astraverify.com/what-is-dkim): DKIM signs outgoing email and publishes the public key in DNS under a selector. Learn how it works, what a selector is and why 2048-bit keys matter.
- [What is DMARC? Policies, alignment and reports explained](https://astraverify.com/what-is-dmarc): DMARC tells receivers what to do when mail fails SPF and DKIM alignment and reports who sends as your domain. Learn none, quarantine, reject and rollout.
- [What are MX records? How email routing works](https://astraverify.com/what-are-mx-records): MX records tell the world which servers accept email for your domain. Learn how priority works, what a null MX is and the mistakes that break delivery.
- [How the AstraVerify email security score works](https://astraverify.com/email-security-score): AstraVerify scores a domain out of 100: MX 25, SPF 25, DKIM 20, DMARC 30. Learn what earns points, why a score is capped while a fix is open and how to reach 100.
- [robots.txt for search and AI crawlers: what to allow](https://astraverify.com/robots-txt-for-ai-crawlers): How robots.txt controls Googlebot, Bingbot, GPTBot, ClaudeBot and PerplexityBot, why the Sitemap line must be absolute, and the wildcard mistakes to avoid.
- [How to make your site readable by ChatGPT, Perplexity and Claude](https://astraverify.com/ai-crawler-access): Why AI answer engines cannot cite a site they cannot fetch: CDN bot blocks, challenge pages and robots rules, and how to allow OAI-SearchBot and PerplexityBot.
- [What is llms.txt? A plain-text summary for AI agents](https://astraverify.com/what-is-llms-txt): llms.txt is a plain-text file at your site root that tells language models what the site is, who it is for and where the main pages are. Format and example.
- [JSON-LD structured data for small business sites](https://astraverify.com/json-ld-for-small-business-sites): The three JSON-LD blocks every small business or SaaS site needs (Organization, WebSite, a page type), with copy-ready examples and the mistakes to avoid.
- [www vs apex: pick one host and redirect the other](https://astraverify.com/www-vs-apex-canonical-host): Why serving your site on both www and the bare domain splits ranking signals, how to choose a canonical host, and the redirect and canonical-tag rules that fix it.
- [How the Discoverability score is calculated](https://astraverify.com/discoverability-score): The five parts of the Discoverability score: crawl access, plumbing, metadata, structured data, answer-engine readiness. Why blocking AI crawlers costs points.
- [The AstraVerify seal: how to add it to your website](https://astraverify.com/domain-trust-seal): A small badge telling visitors mail from your domain is authenticated (SPF, DKIM, DMARC enforced), verified live. One line of HTML for any site or CMS.
- [Gmail and Yahoo sender requirements: check your domain](https://astraverify.com/gmail-yahoo-sender-requirements): Gmail, Yahoo and Outlook sender rules in one table: SPF, DKIM, DMARC, alignment, one-click unsubscribe, spam rate. Which ones a domain check covers, and the fixes.
- [Is my site blocking GPTBot, ClaudeBot or PerplexityBot? A two-minute check](https://astraverify.com/is-my-site-blocking-gptbot-claudebot): Three checks that show whether AI crawlers can read your site: what each bot token does, how to read robots.txt for them, and fetching a page as GPTBot or ClaudeBot.
- [Check your llms.txt: what a valid file needs](https://astraverify.com/llms-txt-checker): Six checks for an llms.txt file: location, status, content type, structure, the one-sentence definition and the links. What the scan tests and how to fix each one.
- [AstraVerify vs MXToolbox, dmarcian and EasyDMARC: how to choose](https://astraverify.com/astraverify-vs-mxtoolbox-dmarcian-easydmarc): Four tools that read the same DNS records for different jobs: when a one-page domain check is enough, when you need a DMARC report platform, where MXToolbox fits.
- [Core Web Vitals for a small business site: what to fix first](https://astraverify.com/core-web-vitals-small-business-site): LCP, CLS and INP explained through the five causes behind most small-site scores, each with a one-line fix, and what fixing our own site took: CLS 0.11 to 0.
- [SPF ~all vs -all: what the difference is and how to move safely](https://astraverify.com/spf-softfail-vs-fail): What ~all (softfail) and -all (fail) tell receivers, why ~all is the most common SPF finding on business domains, and three steps to reach -all without losing mail.

## API (JSON, rate limited, for non-commercial use)
- https://astraverify.com/api/check?domain=yourdomain.com: email scan (MX, SPF, DKIM, DMARC, score, recommendations)
- https://astraverify.com/api/discoverability?domain=yourdomain.com: cached discoverability facts (GET never fetches the target; a scan is started from the site)
- https://astraverify.com/api/public/statistics: aggregate statistics

## For AI assistants (MCP)
- MCP server: https://astraverify.com/mcp (Streamable HTTP, no auth required; tools: check_email_security, check_discoverability, get_report, fetch_as_crawler, verify_fix)
- OpenAPI: https://astraverify.com/openapi.json
- Setup: https://astraverify.com/connect

## Crawler
- https://astraverify.com/bot: what AstraVerifyBot fetches and how to block it
- https://astraverify.com/terms: terms of use
- https://astraverify.com/privacy: privacy policy