HomeDeveloper ToolsEmail Health Check

email setup. instant grade.

check if your domain's email authentication is set up correctly. scan SPF, DKIM, and DMARC records and get a letter grade.

What this tool does

Enter a domain and get a health check on its email configuration: SPF, DKIM, DMARC records, and MX server setup. Identifies the most common deliverability problems before your email starts going to spam.

Three records that determine whether email works

SPF (Sender Policy Framework)

A DNS TXT record listing the servers authorized to send email on behalf of your domain. When a receiving mail server gets a message claiming to be from you@example.com, it checks the sending IP against the SPF record for example.com. If the IP is not in the list, the message is suspicious.

A typical SPF record looks like:

text
v=spf1 include:_spf.google.com include:sendgrid.net ~all

The ~allat the end is “soft fail” — anything not on the list is suspicious but not auto-rejected. -allwould be “hard fail.” Most teams use ~all to avoid bouncing legitimate edge cases.

DKIM (DomainKeys Identified Mail)

A cryptographic signature attached to every outbound email from your domain. The receiving server fetches your public key from DNS and verifies the signature matches. A valid DKIM signature proves the message was actually sent by someone in possession of your private key — not a spoofer.

DKIM keys are configured per-sending-service. Gmail Workspace, SendGrid, Mailgun, Resend, Postmark — each gives you a DKIM key to publish in DNS. If you send through three services, you publish three DKIM records.

DMARC (Domain-based Message Authentication)

A policy that tells receiving servers what to do with mail that fails SPF or DKIM. A typical DMARC record:

text
v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; pct=100
  • p=none — observe but do nothing. The starting point for any new DMARC deployment.
  • p=quarantine — failed mail goes to spam.
  • p=reject — failed mail is bounced outright. The strongest setting; only safe once SPF and DKIM are reliably passing for all legitimate sources.

The rua tag tells the receiving server where to send aggregate failure reports. Pointing this at an inbox you actually read is how you catch misconfigurations before they cost you deliverability.

The order to set these up

When standing up email for a new domain:

  • 1. SPF first. Add a record that lists every service that sends mail as you. Test by sending from each.
  • 2. DKIM second. Configure each sending service. Verify the key is reachable in DNS.
  • 3. DMARC last, in monitoring mode. Start with p=none and a working rua address. Watch the reports for a few weeks.
  • 4. Move DMARC to enforcement. Once reports show all your real mail passing, step up to p=quarantine, then to p=reject if you want maximum spoofing protection.

Why your transactional email lands in spam

Most “our emails go to spam” cases trace back to an SPF record that does not include the transactional sender, or a missing DKIM record for that service. Receivers like Gmail aggressively penalize mail from domains with broken or missing authentication. The fix is usually 10 minutes of DNS work; finding the gap is what this tool is for.

What this tool checks

Given a domain, the tool queries DNS for SPF, DKIM selectors at common locations, DMARC, and MX records, and reports any that are missing, malformed, or potentially misconfigured. The check is read-only and consults public DNS records — your domain's mail does not change as a result of running it.

What this tool does

Enter a domain and get a health check on its email configuration: SPF, DKIM, DMARC records, and MX server setup. Identifies the most common deliverability problems before your email starts going to spam.

Three records that determine whether email works

SPF (Sender Policy Framework)

A DNS TXT record listing the servers authorized to send email on behalf of your domain. When a receiving mail server gets a message claiming to be from you@example.com, it checks the sending IP against the SPF record for example.com. If the IP is not in the list, the message is suspicious.

A typical SPF record looks like:

text
v=spf1 include:_spf.google.com include:sendgrid.net ~all

The ~allat the end is “soft fail” — anything not on the list is suspicious but not auto-rejected. -allwould be “hard fail.” Most teams use ~all to avoid bouncing legitimate edge cases.

DKIM (DomainKeys Identified Mail)

A cryptographic signature attached to every outbound email from your domain. The receiving server fetches your public key from DNS and verifies the signature matches. A valid DKIM signature proves the message was actually sent by someone in possession of your private key — not a spoofer.

DKIM keys are configured per-sending-service. Gmail Workspace, SendGrid, Mailgun, Resend, Postmark — each gives you a DKIM key to publish in DNS. If you send through three services, you publish three DKIM records.

DMARC (Domain-based Message Authentication)

A policy that tells receiving servers what to do with mail that fails SPF or DKIM. A typical DMARC record:

text
v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; pct=100
  • p=none — observe but do nothing. The starting point for any new DMARC deployment.
  • p=quarantine — failed mail goes to spam.
  • p=reject — failed mail is bounced outright. The strongest setting; only safe once SPF and DKIM are reliably passing for all legitimate sources.

The rua tag tells the receiving server where to send aggregate failure reports. Pointing this at an inbox you actually read is how you catch misconfigurations before they cost you deliverability.

The order to set these up

When standing up email for a new domain:

  • 1. SPF first. Add a record that lists every service that sends mail as you. Test by sending from each.
  • 2. DKIM second. Configure each sending service. Verify the key is reachable in DNS.
  • 3. DMARC last, in monitoring mode. Start with p=none and a working rua address. Watch the reports for a few weeks.
  • 4. Move DMARC to enforcement. Once reports show all your real mail passing, step up to p=quarantine, then to p=reject if you want maximum spoofing protection.

Why your transactional email lands in spam

Most “our emails go to spam” cases trace back to an SPF record that does not include the transactional sender, or a missing DKIM record for that service. Receivers like Gmail aggressively penalize mail from domains with broken or missing authentication. The fix is usually 10 minutes of DNS work; finding the gap is what this tool is for.

What this tool checks

Given a domain, the tool queries DNS for SPF, DKIM selectors at common locations, DMARC, and MX records, and reports any that are missing, malformed, or potentially misconfigured. The check is read-only and consults public DNS records — your domain's mail does not change as a result of running it.

more free tools

PDF utilities, image tools, developer helpers — all free, no signup.

Something wrong?