Domain Email Health Check

What this scorecard measures

Inbox placement is decided by a small set of DNS records that mail receivers (Gmail, Outlook, Yahoo, corporate gateways) read before they accept a message. This tool checks all of them at once for the domain you enter.

MX - where mail is delivered

An MX (Mail eXchanger) record tells other servers which hosts accept mail for your domain, in priority order (lowest number first, per RFC 5321 §5.1). No MX record means the domain cannot receive email at all. An MX target must be a hostname with an A/AAAA record - it may not point at an IP literal or a CNAME.

SPF - who may send as you

SPF (Sender Policy Framework, RFC 7208) is a single TXT record listing the servers allowed to send mail for your domain, ending in an all qualifier. -all (hard fail) is the goal; ~all (soft fail) is a safe interim; ?all (neutral) and especially +all (pass everything) offer little or no protection. SPF evaluation is also capped at 10 DNS lookups - exceeding it produces a PermError and the record stops working.

DKIM - proof the message wasn't altered

DKIM (DomainKeys Identified Mail, RFC 6376) publishes a public key at <selector>._domainkey.<domain>. Outgoing mail is signed with the matching private key so receivers can verify the message body and key headers weren't tampered with. Selectors can't be discovered from DNS, so this tool probes the selectors used by major providers (Google google, Microsoft 365 selector1/selector2, Amazon SES, Mailchimp k1, Zoho, Fastmail, and more). If your provider uses a custom selector, read the s= tag of a real DKIM-Signature header.

DMARC - what to do on failure, plus reporting

DMARC (RFC 7489) sits on top of SPF and DKIM. The record at _dmarc.<domain> sets the enforcement policy with p=: none only monitors, quarantine sends failing mail to junk, and reject blocks it outright. A rua= address turns on the daily aggregate reports that tell you who is sending mail as your domain - without them you are enforcing blind.

Blacklist - is the sending IP burned?

Even with perfect authentication, a listed IP gets mail throttled or rejected. We resolve your primary MX host to an IPv4 address and check it against Spamhaus ZEN, SpamCop, and Barracuda. A listing usually means a compromised account, an open relay, or a bad neighbour on shared hosting; fix the cause, then request delisting at each provider.

Reading the grade

The overall score weights the checks by deliverability impact: SPF and DMARC 25% each, MX and DKIM 20% each, blacklist 10%. A+/A means full authentication with enforcement; B/C usually means SPF or DMARC is published but not yet at full strength; D/F means one or more core records are missing.