The domain health signal is a daily check that the domain's nameservers still delegate to the DNS Winnr manages (and, for some domains, that the sending identity Winnr set up is still verified). Green = healthy delegation, red = the delegation is broken or the sending identity fell out of verification. It does NOT re-check SPF/DKIM/DMARC/MX — those live in a separate per-record view on the domain's detail panel. Click a domain to see both.
What the health signal means
The health color is driven by one thing: whether the domain's nameservers still delegate to the DNS Winnr manages. For some domains, it also checks that the sending identity Winnr set up is still verified. That's it — this signal does not re-validate SPF, DKIM, DMARC, or MX.
Green / Healthy — The domain still delegates to the DNS Winnr manages (and, where applicable, the sending identity is verified). Everything's plumbed correctly.
Red / Failing — The delegation is broken. The nameservers were changed at your registrar, the domain was transferred, or the delegation was removed — so Winnr can no longer manage the domain's DNS. For some domains, this also fires if the sending identity drops out of verified status. Fix the delegation to clear it.
Grey / Unchecked — Newly connected, the check hasn't run yet. The domain turns healthy as soon as it verifies.
What the health check looks at
The check runs once a day (and on demand when you click Recheck). It confirms:
- Nameserver delegation — the domain's NS records still point at the DNS Winnr manages
- Sending identity (only for some domains) — the sending identity Winnr set up is still in verified status
If either fails, the domain's health flips to failing and you'll see a notification (if you have email notifications enabled in Settings).
What the domain detail panel shows you
The per-record view is separate from the health color. Click a domain in the Domains list and the detail panel shows each authentication record — MX, SPF, DKIM, DMARC — with its own verified/unverified state, checked live when you open the panel. This is where you confirm the individual records are in place; it does not change the health signal.
- MX —
10 inbound.yourdomain.com(priority 10, host inside your own domain) - SPF (TXT at apex) — the full string includes Winnr's send authorization and ends in
-all - DKIM (TXT at
dkim._domainkey) — matches the public key on file - DMARC (TXT at
_dmarc) — the policy record (Winnr provisionsp=rejectby default)
If a record shows unverified here, use "Show expected value" to get the exact record and compare it against your DNS provider. If Winnr manages your DNS (nameserver delegation or a Cloudflare token), click Recheck after correcting; if you set the records up manually, paste the expected value into your provider's control panel, then recheck once propagation is likely (usually within an hour).
DMARC policy
Winnr provisions DMARC as p=reject by default — the strong anti-spoofing policy that tells receivers to reject mail failing authentication. You can change the policy from the domain's detail panel (DMARC override) if you have a reason to loosen it (for example while you sort out a second sending service on the same domain). There's no time-based auto-tightening — the policy stays whatever's set.
(The one exception: pre-warmed marketplace domains ship on p=none, because Winnr owns and manages their DNS end-to-end and the customer never touches it.)
What the health signal doesn't tell you
The health signal is about delegation — not about sending reputation, and not about the individual authentication records. A green domain can still have poor deliverability if:
- The mailboxes are new and unwarmed
- You're sending high volume too fast
- Recipients are marking your emails as spam
- The domain is on a blacklist
For those, watch inbox rate (in Warming), blacklist status (in Marketplace or via manual tools), and reply rates. DNS health only tells you the plumbing is right.
What's next
Frequently asked questions
How often does Winnr check DNS health?
Once a day. A newly-connected domain turns healthy as soon as it verifies — you don't have to wait for the next daily run. You can also force a recheck any time from the domain's detail panel.
What causes a domain to go from healthy to failing?
The nameservers changed at your registrar so the domain no longer delegates to the DNS Winnr manages, or the delegation was removed entirely. For some domains, the health signal also fails if the sending identity Winnr set up drops out of verified status.
My domain is failing but I didn't touch DNS. What now?
Check the nameservers at your registrar — a registrar-side change or a domain transfer can quietly reset them. Click Recheck on the domain's detail panel. If it stays red, the domain's NS records need to point back at the DNS Winnr manages.
Does the health signal check my SPF, DKIM, and DMARC?
No — the health color is driven only by nameserver delegation (plus, for some domains, the sending-identity verification). SPF, DKIM, DMARC, and MX have their own live per-record view on the domain's detail panel. A domain can be green on health while a single record shows unverified in that panel.
Do I need DMARC set to p=quarantine or p=reject?
Winnr sets DMARC to p=reject by default when it provisions the records, which is the strong anti-spoofing policy. You can change the policy from the domain's detail panel (DMARC override) if you have a reason to loosen it. There's no time-based auto-tightening — the policy is whatever's set.
What if a domain shows red/failing?
Fix the delegation. Click the domain, check the nameservers it should be pointing at, and update them at your registrar. Once the nameservers are corrected, click Recheck.