Free tool
Email health check
Enter a domain and we will read its live SPF, DMARC and MX records, follow the SPF include chain to count the lookups it really costs, and check any DKIM selectors you name. Every finding explains what it means and what to change.
What it checks, and what it cannot
Being specific about the limits is the point. A tool that reports a confident score from DNS alone is telling you something it cannot know.
It can tell you
- Whether SPF exists, parses, and stays inside the ten-lookup limit once includes are followed.
- Whether more than one SPF or DMARC record is published, which breaks both.
- What your DMARC policy is actually enforcing, including on subdomains.
- Whether aggregate reporting is configured and where it goes.
- Whether a DKIM selector you name has a valid, non-revoked key.
- Whether mail addressed to the domain can be delivered at all.
It cannot tell you
- Whether a given message will land in the inbox or in spam.
- Your sender reputation at any particular provider.
- Which DKIM selectors exist, unless you supply the names.
- Whether the systems listed in SPF are ones you still use.
- Whether your content or list practices are causing complaints.
- Anything about mail already sent — DNS describes configuration, not history.
About this tool
Does this tell me whether my emails reach the inbox?
No, and be suspicious of anything that claims to. This reads your public DNS records. Inbox placement depends on sender reputation, recipient engagement and each provider’s own filtering, none of which appear in DNS. What this can tell you is whether your configuration gives a receiving server a technical reason to filter you — which is where most problems actually start.
Why does it say DKIM was not tested?
Because DKIM keys are published under a selector name chosen when sending was set up, and DNS has no operation that lists the names under a prefix. There is genuinely no query that answers “which selectors does this domain use?”. We try a short list of common names as a convenience, but a miss means nothing. Supply your selector — it is the s= tag in the DKIM-Signature header of any message you have sent — and we will check it properly.
What does the SPF lookup count mean?
RFC 7208 limits a receiving server to ten DNS-querying terms when evaluating your SPF record. Over that, the result is a permanent error and SPF effectively fails. The count is not the number of includes in your record: each include pulls in the lookups inside the record it points at, so four includes routinely cost twelve. We follow the chain and report the real total.
Is my domain or the result stored anywhere?
No. The check runs, the result is returned to your browser, and nothing is written to a database. We do not ask for an email address, and submitting a domain does not put you on any list. Standard server request logs apply, as they would for any page.
Can I check a domain I do not own?
Yes — every record this reads is public DNS, available to anyone with a DNS client. The tool performs no connection to the domain’s servers beyond standard DNS queries, does not scan ports, and does not attempt to send mail. There is a rate limit per visitor to keep it that way.
The results look fine but my mail still goes to spam.
Then the cause is not your DNS, which is genuinely useful to know — it rules out an entire category. What remains is sender reputation, sending behaviour or content. Diagnosing that needs raw message headers from a filtered message, plus Google Postmaster Tools and Microsoft SNDS data where you have access. Send us what you have and we will look.