What it checks
Everything here comes from public DNS, the same records Gmail, Outlook and Yahoo look up when your mail arrives. The SPF check follows every include all the way down, because the 10-lookup limit counts nested includes and most quick checkers only count the top line.
| Check | What it is | What we flag |
|---|---|---|
| SPF | Which servers may send as your domain. | No record, two records, +all, more than 10 DNS lookups once every include is followed, includes that point at nothing. |
| DKIM | A public key receivers use to confirm a message wasn't changed and really came from you. | No key at the selectors we try (or the one you give us), keys under 2048 bits, keys left in test mode, revoked keys. |
| DMARC | What receivers should do with mail that fails SPF and DKIM, and where to send reports. | No record, more than one, p=none left in place, no report address, report addresses that haven't authorised themselves, strict alignment, unprotected subdomains. |
| MX | Where mail to your domain is delivered, and so which provider hosts it. | No MX, a null MX on a domain you send from. We also name the provider and link its setup guide. |
| BIMI | Shows your logo next to your mail in inboxes that support it. | Missing DMARC enforcement, a logo that isn't an HTTPS SVG, no certificate (Gmail needs one). |
| MTA-STS and TLS-RPT | Make other servers use encryption when they deliver to you, and report when they can't. | A record with no policy file behind it, policies left in testing, MTA-STS without TLS reports. |
Reading the result
- Fix means something is broken now. Mail can fail authentication because of it, or the record is ignored.
- Check means it works but leaves a gap, like DMARC at
p=noneor a 1024-bit DKIM key. - Optional is for BIMI and MTA-STS. Most small businesses can live without them until the basics are done.
- Fine is fine.
The order matters. Get SPF and DKIM passing for every service that sends as you, then publish DMARC, then tighten DMARC. Moving DMARC from p=none to reject walks through that last part.
What it can't see
Records being right doesn't mean mail lands in the inbox. Gmail and Microsoft also weigh your sending reputation, complaint rate, bounces, how mail is sent and what it says. None of that is in DNS. We say so on every result rather than hand out a score that implies otherwise.
Blocklists aren't checked either. The big ones refuse lookups made through shared resolvers, so an answer from here would be noise.
Setup guides by provider
When the checker recognises your mail provider from its MX records, it links the matching guide. All of them are here:
- Google Workspace guide
- Microsoft 365 guide
- Zoho Mail guide
- GoDaddy guide
- Namecheap guide
- Cloudflare DNS guide
Problem guides: SPF has too many DNS lookups, two SPF records, finding a DKIM selector, reading DMARC reports. The rules the big mailbox providers enforce are in Gmail, Yahoo and Outlook sender requirements.
Privacy, in short
The domain you type is looked up and thrown away. It isn't stored or logged by us. To stop the tool being used for bulk scanning, each connection gets 10 checks an hour, counted under a one-way scrambled form of the IP address that expires after two hours. The optional "email me the fixes" form keeps what you type in it (email, name, domain, note) for up to 12 months so we can reply. Details are in the privacy notice.
Questions people ask
Is it really free?
Yes. No sign-up, no email needed to see the result. If you want the fixes written up for your setup, there's an optional form under the result.
Why does it say DKIM wasn't found when I know it's on?
DKIM keys live at a name that includes a selector, and only the sending service knows which one it uses. We try the common ones. If yours is custom, open a message you sent, find s= in the DKIM-Signature header, and run the check again with that selector.
Does it check blocklists?
No. The public blocklists refuse queries that come through shared DNS resolvers like the one this tool uses, so any answer would be unreliable. A listing check needs a dedicated resolver; it's part of the paid audit.
How often do DNS changes show up?
Usually within minutes. The record's TTL can hold an old answer for up to that many seconds, often an hour. If the checker still shows the old record, wait out the TTL and check again.
Do you keep the domain I type?
No. The domain isn't written anywhere. To stop abuse we count checks per connection for one hour, using a scrambled form of your IP address that's deleted after two hours.
I sent the report request. What happens next?
We reply by email with the fixes written for your setup and provider. Most replies arrive within the hour, always within one business day. Nothing else is sent to you unless you write back.