Free tools

Email deliverability tools

Four DNS records decide whether a mailbox provider trusts mail from your domain — and three of them are invisible until something stops arriving. Check them here. No account, nothing to install, and the result is a link you can send to whoever owns the zone.

Runs every check below and grades the result out of 100.

One record at a time

◈Email DNS checkSPF, DKIM, DMARC, MX and more in one report, with a score.◆SPF checkerRead the policy, follow every include, count the ten-lookup budget.▣DKIM checkerFind the key, read its size, and catch a revoked or test-mode record.▲DMARC checkerPolicy, reporting, alignment — and whether reports actually arrive.▤MX checkerWhere mail is delivered, and the mistakes DNS will not report.▥Email header analyzerPaste the headers: the receiver's verdict, alignment, and where the time went.◇DMARC generatorBuild a record you can publish, and know what each tag will do.◎SMTP server testConnect to a mail server: banner, TLS, certificate, open relay.

What these records actually do

A receiving server has no way to know that a message claiming to come from your domain really did. Everything it can check is published by you, in DNS, and the four records below are the whole of it.

  • SPF lists the servers allowed to send for your domain. Its hidden failure mode is arithmetic: the record may only cost ten DNS lookups once every include: behind it is followed, and adding one more provider silently breaks the whole thing.
  • DKIM is a signature over the message itself, checked against a public key in your DNS. A key left in test mode or published with an empty value looks correct in the zone and verifies nothing.
  • DMARC tells receivers what to do when the first two fail, and asks them to report who is sending as you. Most published DMARC records say p=none — do nothing — which is where everyone starts and where most domains stay.
  • MX is where mail addressed to your domain is delivered. It is the one people believe is simple, and the one that quietly breaks when an exchange becomes an alias or loses its address record.

How to use these

Start with the full report: it runs all four, scores what it found, and tells you which one to fix first. The single-record pages go deeper — the SPF one walks your entire include tree and shows which provider is spending your lookup budget, and the DMARC one checks something almost nothing else does: whether the domain receiving your aggregate reports has authorised itself to receive them.

Everything is read straight from public DNS through several resolvers. Nothing is stored, and a check that cannot be completed says so rather than reporting your records as missing.

Related reading