Free Tools / Email Domain Health Checker
Email Domain Health Checker
Enter your domain for a plain-English report on the records that decide whether your email is trusted or spoofable: MX, SPF, DKIM, DMARC and its enforcement level, reverse DNS, and TLS. Every finding comes with what it means and how to fix it.
Uses public DNS only, over DNS-over-HTTPS. DKIM is detected by probing common selectors, so a key under a custom selector may not be found. Rate limited.
What this checks, in plain English
MX (mail exchange) records point to the servers that receive your email. No MX means the domain cannot receive mail at all.
SPF (Sender Policy Framework) is a DNS record listing which servers may send as your domain. Ending it in -all (or ~all) tells receivers to reject or flag anything else. +all authorizes everyone and is effectively no protection.
DKIM (DomainKeys Identified Mail) cryptographically signs your outgoing mail so receivers can confirm it really came from you and was not altered.
DMARC ties SPF and DKIM together and sets a policy: p=none only watches, while p=quarantine and p=reject actually stop impersonation. Most domains that "have DMARC" are stuck at p=none and are still spoofable.
Reverse DNS and TLS round out deliverability: a matching PTR record and encrypted transport (MTA-STS) help your mail reach the inbox instead of the spam folder.
Common problems we see
- DMARC left on p=none. Reports are collected but nobody moved to enforcement, so the domain is still spoofable.
- Microsoft 365 or Google Workspace not in SPF. After a migration, the old provider is removed but the new one is never added, so legitimate mail starts failing SPF.
- SPF over 10 lookups. Too many
include:mechanisms make SPF return permerror and get ignored. - DKIM never enabled. A one-time setting in the mail provider that often gets skipped.
Frequently asked questions
What is SPF?
SPF (Sender Policy Framework) is a DNS TXT record that lists which mail servers are allowed to send email for your domain. Receiving servers use it to detect forged senders.
What is DKIM?
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to your outgoing email so receivers can confirm it was really sent by your domain and was not altered in transit.
What is DMARC and why does p=none matter?
DMARC ties SPF and DKIM together and tells receivers what to do with mail that fails. A policy of p=none only monitors: forged mail is still delivered. Moving to p=quarantine or p=reject actually stops impersonation, but should be done after reviewing your legitimate senders.
Is this a DMARC, SPF, and DKIM checker in one?
Yes. It looks up your MX records, SPF, DKIM (probing common selectors), DMARC and its enforcement level, reverse DNS, and TLS hardening, then explains each result in plain English.
Fixing email authentication safely, without breaking valid mail, is exactly the kind of work we do. Talk to us or see our other free tools.