Each finding comes with what to change. For the many problems that one DNS record solves, the record is ready to copy, and once you have made the change you can check it in seconds instead of waiting for the next audit.

Fix a finding

Pick what to fix first. The Do these first card at the top of the domain’s page names the three findings that matter most, the quickest to fix first when they weigh the same. The dashboard ranks fixes across all your domains by the points they bring back.
Open the finding and read it. Each finding takes one line until you open it (or press O on it). Its explanation says why it matters, Fix says what to change, Evidence shows what the audit saw, and Read the guide opens the related guide when there is one.
Copy the record, if there is one. The Ready to copy box gives the type, the name and the value of the DNS record to publish, each with a Copy button. Add it at your DNS provider. When it replaces a record you already have, the box shows the current one.
Check the fix. Press Check if it is fixed under the finding. Only that check runs again, in seconds, and the answer appears under the button.
Let the next audit confirm it. The finding leaves the report, and the score goes up, at the next full audit. Press Audit now on the domain’s page if you do not want to wait.

Records ready to copy

They are given for SPF, DMARC, CAA, MTA-STS, TLS reporting, and for domains that receive no mail. Each record is built for your domain from what the audit saw:

SPF: your mail provider, recognised from your mail servers, with what your current record already allows kept.
DMARC: your current settings kept; with DMARC reports turned on, the record includes the address that sends them to us.
CAA: the certificate authorities that actually issue your certificates, so renewals keep working.
MTA-STS: the DNS record and the policy file, with its address and its content.
A domain that receives no mail: a “null MX” record that tells senders so.

Some DNS panels add the domain to the name for you. If yours does, enter only the part before it, for instance _dmarc rather than _dmarc.example.com.

Before publishing an SPF record, make sure every service that sends mail as your domain (newsletter tool, invoicing, help desk…) is in it: a service left out would see its mail rejected or sent to spam.

Check if it is fixed

The button appears on the findings of the latest audit of a proved domain. It re-runs only the check behind that finding and answers:

Fixed: not found any more. The finding leaves the report at the next audit.
Still there. DNS changes can take a few minutes to be seen: try again a little later.
The check could not run this time. Try again in a minute.

A few findings cannot be checked on their own, such as those that come from outside databases (breaches, version data of exposed services); the next audit tells you. Viewers cannot use the button, and a workspace can run up to 30 checks an hour.

Other ways to act on a finding

Apply in your DNS (Agency plans): makes the change in your Cloudflare, OVHcloud or Gandi zone for you. See DNS fixes in one click.
Open a ticket (Agency plans): sends it to GitHub, Jira or Linear. See Tickets.
Accept this finding: when it is a false positive or a trade-off you accept. See Accept a finding as a risk.