Email DNS · one report
Email Domain Health Check
Run every email DNS check at once: MX, SPF, DMARC, a DKIM selector scan, MTA-STS, TLS reporting and BIMI. You get a pass, warn or fail checklist and a prioritised list of fixes.
Lookup
What the health check looks at
- MX: whether the domain receives mail, through which provider, and whether every mail server resolves.
- SPF: exactly one valid record, within 10 DNS lookups and 2 void lookups, ending in
~allor-all. - DMARC: a valid record, how strongly it is enforced, and whether aggregate reports are requested.
- DKIM: a scan of common selectors, with key type and length.
- MTA-STS and TLS-RPT: optional records that make delivery to you require TLS and report when it fails.
- BIMI: an optional logo record that only works with an enforced DMARC policy.
Why there is no score
A single number hides what matters: a domain with every optional record but no DMARC policy is still easy to spoof. The checklist puts failures first, then warnings, and every item links to the detailed checker. Two limits apply to any DNS-only check. DKIM selectors can be any name, so “not found” is a warning rather than proof. And the MTA-STS policy itself is a file on a web server, which this browser-only tool does not fetch.
Frequently asked questions
Why is there no overall score?
Scores mislead: they weigh optional extras against essentials. A plain checklist shows exactly what is wrong and what to fix first.
Why does DKIM show a warning even though I set it up?
The check can only try common selector names. If your provider uses a custom or random selector, it is not found. Read the s= tag from the DKIM-Signature header of one of your messages and check it in the DKIM checker.
Do I need MTA-STS, TLS-RPT and BIMI?
No. SPF, DKIM and DMARC are the essentials, and Gmail and Yahoo require them from bulk senders. MTA-STS and TLS-RPT strengthen the security of mail sent to you, and BIMI only adds a logo in some mail apps.
How often should I check my domain?
After any change to your email providers or DNS, and whenever you add a service that sends mail as your domain, because each one has to be covered by SPF and should sign with DKIM.