Setting up AstraVerify: what an admin should do
Last updated 2026-10-17
A scan tells you how a domain is configured today. Most of what follows turns that one reading into something that keeps working: evidence about who really sends as you, a weekly check that notices when something changes, and a way to tell us which questions do not apply to a name. They are listed in the order we would do them, which is the order of what each is worth rather than how hard it is.
1. Scan the domain, and work down the list
No account needed. Enter the domain at astraverify.com and you get both scores out of 100, every component and its points, and the exact DNS record, file or tag to publish for each finding.
The fixes are already ranked: critical first, then important, then informational. Work down that order rather than picking the easy ones, because the ranking is about what each finding costs you, not how long it takes to fix.
Some findings are marked as needing no action. Those are real facts about your setup that you cannot change — a key length your provider chose, for instance. They carry no points and they are not work.
2. Point your DMARC reports at us
This is the one worth doing first if you only do one. Everything above is what your domain publishes; this is what actually happened to your mail.
Add our reporting address to the rua tag in your DMARC record. Receivers — Google, Microsoft, Yahoo — then send us daily reports naming every service that sent mail as your domain, how much, and whether it authenticated. The address is specific to your domain and is shown on your report page.
What it buys: you find out about a service sending as you that nobody told you about, before a receiver decides to stop trusting your mail. It is also the only way to know whether moving to p=reject is safe, rather than a guess.
v=DMARC1; p=none; rua=mailto:r-<your-token>@astraverify.com3. Turn on monitoring
A domain is not a thing you fix once. DNS gets edited, certificates expire, a marketing tool gets added, a CDN rule changes. Monitoring re-scans weekly and emails you only when something has actually changed since last time.
It also checks every hour whether the site is answering at all, and watches the certificate on every published address. The uptime alert waits for a second failed check before telling you, so a momentary blip stays quiet.
4. Confirm the DKIM selector your mail really uses
DKIM selectors cannot be listed from DNS — you can only ask whether a specific one exists. So a scan guesses from the selectors services commonly use, and a service using an unusual one looks like no DKIM at all.
Sending one email to the address shown on your report settles it. We read the signature, record the selector your mail actually carries, and score it from then on. It takes a minute and it is the difference between a guess and a fact.
5. Tell us what a name is not for
Not every name does everything. A sending subdomain has no website; a portal sends no mail. Scored against both roles, those names collect findings for things they were never meant to do, and the red is noise.
You can declare a name out of the mail role or the web role from the link in your report. We honour the declaration unless what we observe contradicts it — a name declared to send no mail that we then watch send mail keeps its full scan, because the evidence outranks the claim.
6. Connect Google Search Console
We read your sitemap and tell you it is valid. Google reads the same sitemap and may decline to index half of it. Both are true and only one is the answer you wanted.
Add our service account as a user on your Search Console property and we will ask Google, for the pages we already found, which ones it indexed and which it did not — in Google’s own words, so you can search the reason and act on it. Read-only, and you can remove it at any time from the same screen.
[email protected]7. Show the seal
A domain whose mail is authenticated end to end earns a seal you can put in your footer. It re-checks itself every week and links to a verification page, so it stops showing if the thing it claims stops being true.
It is the only part of this that works on your visitors rather than on you.
8. Connect your AI assistant
AstraVerify runs as an MCP server, so Claude, ChatGPT and other assistants can scan a domain, fetch a page as a named crawler and re-check a single fix without leaving the conversation. Useful when the person asking the question is not the person who will run the tool.
9. Send the report to whoever runs the DNS
The person who scans a domain is usually not the person who can change it. Every report can be forwarded with a note, and the link opens the saved findings without rescanning — so what they read is what you saw, not a fresh scan that may have changed underneath the conversation.