Foundations
The infrastructure under the name: DNS, registry health, and whether your email actually lands.
0.15 of the composite scoreWhy does this matter — for rankings, traffic and trust?
Foundations failures are binary: a held domain, an expired registration or a broken DNS zone does not degrade your marketing — it deletes it. Every campaign, every ranking, every AI citation routes through a handful of DNS records and a registrar row, and nobody looks at them until the day they fail.
The quieter half of this axis is email. SPF, DKIM and DMARC decide whether your invoices, password resets and newsletters arrive or land in spam — and a domain that sends mail with no authentication setup is actively training inbox providers to distrust it. For marketing teams, DMARC is also the only report that shows who is sending as your brand.
Finally, hygiene signals — redundant nameservers, DNSSEC, a sensible registration horizon, clean registry status — are cheap trust. An expiring-in-two-weeks domain or a clientHold status is the kind of thing due-diligence checks find before partnerships do.
Every signal in this division — exactly what the engine checks
How to fix it
What commonly causes failures here
- One nameserver (or two on the same rack) — a single point of failure for the whole domain.
- Domain expiring within ~30 days, or auto-renew tied to a departed employee’s card.
- Sending mail from the domain with no SPF/DKIM/DMARC — straight to spam.
- No MX records while tools (forms, CRM) send as @yourdomain anyway.
- Unsigned DNS zone (no DNSSEC) on a registry that supports it.
- Registry status holds (clientHold, redemptionPeriod) after a missed verification email.
Best-practice setup
A complete zone for a site that also sends mail, plus the three authentication records. Publish DMARC in monitor mode first (p=none), read the reports for two weeks, then tighten.
example.com. 3600 IN A 203.0.113.10
example.com. 3600 IN AAAA 2001:db8::10
www 3600 IN CNAME example.com.
example.com. 3600 IN MX 10 mail.example.com.
example.com. 86400 IN NS ns1.example.com.
example.com. 86400 IN NS ns2.example.com. ; redundancy, different networks
mail 3600 IN A 203.0.113.20; SPF: which servers may send as example.com — one record, ending in -all
example.com. 3600 IN TXT "v=spf1 ip4:203.0.113.20 include:_spf.google.com -all"
; DKIM: sign outgoing mail (selector "s1", key from your mail platform)
s1._domainkey.example.com. 3600 IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkq..."
; DMARC: start monitoring, then enforce
_dmarc.example.com. 3600 IN TXT "v=DMARC1; p=none; rua=mailto:[email protected]"
; …after two weeks of clean reports, tighten to:
; "v=DMARC1; p=quarantine; pct=100; rua=mailto:[email protected]"dig +short MX example.com
dig +short TXT example.com # SPF
dig +short TXT _dmarc.example.com # DMARC
dig +short TXT s1._domainkey.example.com
dig +short NS example.com # expect ≥2, on separate networks