Winnr checks every active domain once a day. The check confirms the domain's nameservers still point at the DNS Winnr manages (and, for some domains, that the sending identity Winnr set up is still verified). A domain that fails gets a red status icon on the Domains page (DNS Issues), and a "Domain Issues Detected" banner appears in the app. Hover the status to see the nameservers the domain needs, fix them at your registrar, and click Re-check Nameservers. The check doesn't re-verify SPF, DKIM, DMARC, or MX, because Winnr maintains those itself on domains whose DNS it hosts.
What the health check means
The daily check is about delegation: whether the domain's nameservers still point at the DNS Winnr manages. For some domains it also checks that the sending identity Winnr set up is still verified. It doesn't re-validate SPF, DKIM, DMARC, or MX.
Each active domain ends up in one of three states:
- Healthy: the domain still points at the DNS Winnr manages (and, where it applies, the sending identity is verified).
- Degraded: something is out of line with the domain's delegation that could cause problems, but mail isn't necessarily failing yet.
- Failing: the delegation is broken. The nameservers were changed at your registrar, the domain was transferred, or the delegation was removed, so Winnr can no longer serve the domain's DNS. For some domains this also fires if the sending identity drops out of verified status.
Where you see it
- Domains page status: an active domain that isn't healthy gets a red status icon instead of the green Active check (the Status filter calls this "DNS Issues", so you can list all of them at once). Hover the icon to see "Nameservers Incorrect", the nameservers the domain should use (with Copy all), and a Re-check Nameservers button.
- Banners: when any domain has a problem, a "Domain Issues Detected" banner with a Review domains link appears in the app, and the Domains page shows a banner with a Re-check All Domains button.
- Domain page: open a domain's "..." menu and choose Manage DNS. The badge at the top reads DNS healthy, DNS degraded, or DNS failing.
- Winnr Agent: ask the agent in the app to check DNS health on up to 10 domains and it runs a live check and reports what it finds.
How to fix a failing domain
- Hover the red status icon (or select the domains and click Nameservers in the action bar) to see the nameservers each domain needs.
- Set those nameservers at your registrar.
- Click Re-check Nameservers, or select the domains and click Re-check NS.
Nameserver changes usually take effect within minutes but can take longer to propagate.
Domains connected with manual DNS records
If you connected a domain by adding the records yourself, Winnr isn't the DNS host, so the daily nameserver check doesn't apply. Instead, the domain shows "DNS Records Pending" until its records verify. Hover that status to see which records are in place and click Verify DNS Records once you've added the missing ones (or select several domains and click Verify DNS in the action bar). After that, keep the records unchanged at your provider.
DMARC policy
Winnr sets DMARC to p=reject by default, the strong anti-spoofing policy that tells receivers to reject mail failing authentication. On domains where Winnr hosts DNS, you can change it from the DNS Records tab (Override DMARC) if you have a reason to loosen it, for example while you sort out a second sending service on the same domain.
Pre-warmed marketplace domains ship on p=none.
What the health check doesn't tell you
The health check is about DNS plumbing, not sending reputation. A healthy domain can still have poor deliverability if:
- The mailboxes are new and unwarmed
- You're sending high volume too fast
- Recipients are marking your emails as spam
- The domain is on a blocklist
For those, watch inbox and spam rates in Warming, and your reply rates. DNS health only tells you the plumbing is right.
What's next
- Diagnose stuck DNS verification
- Add custom DNS records
- Understand SPF, DKIM, and DMARC deeper (free tool)
Frequently asked questions
How often does Winnr check DNS health?
Once a day for every active domain. Opening the Domains page also re-checks any domain that's currently showing a problem, and you can re-check on demand with Re-check Nameservers (one domain), Re-check NS in the action bar (selected domains), or Re-check All Domains in the Domains page banner.
What causes a domain to go from healthy to failing?
The nameservers changed at your registrar, so the domain no longer points at the DNS Winnr manages, or the delegation was removed entirely. For some domains, the check also fails if the sending identity Winnr set up drops out of verified status.
My domain shows DNS Issues but I didn't touch DNS. What now?
Check the nameservers at your registrar. A registrar-side change, an expired domain, or a domain transfer can quietly reset them. Hover its red status icon to see the nameservers the domain should use, correct them at the registrar, and click Re-check Nameservers.
Does the health check look at my SPF, DKIM, and DMARC?
No. It's driven by nameserver delegation (plus, for some domains, the sending-identity verification). On domains where Winnr hosts the DNS, Winnr creates and maintains the SPF, DKIM, DMARC, and MX records itself. On domains connected with manual DNS records, those records are verified when you connect, and the daily nameserver check doesn't apply.
Will I get an email when a domain fails?
No. Problems show up in the app, as the red DNS Issues status icon and the "Domain Issues Detected" banner. If you use webhooks, you can subscribe to the domain.dns_failed event to be notified automatically. See [Webhooks](/help/api-mcp/webhooks.html).
Can I change my DMARC policy?
Yes, on domains where Winnr hosts the DNS. Winnr sets DMARC to p=reject (with a reporting address) by default. To change it, open the domain's "..." menu, choose Manage DNS, open the DNS Records tab, and click Override DMARC. Reset to default puts Winnr's policy back. You can also override DMARC on many domains at once from the DNS button in the action bar, or ask the Winnr Agent. There's no time-based auto-tightening; the policy stays whatever's set.