Skip to content

Email & DNS health:Will your emails land in the inbox?

Check SPF, DKIM, DMARC and MX for your domain and get the exact records to add when something is missing.

A domain, a website address or any email address at the domain.

  • Free, no account
  • Results in about 5 seconds
  • Any domain, whoever hosts your email
Example result

example-shop.hr

Google Workspace

Sample shop · the same check you get for your own domain

Run it on your site

3 problems can send mail from example-shop.hr to spam or let others send as you. 4 optional records would add protection.

Your records

DNS records for email on example-shop.hr
RecordWhat DNS answeredStatus
MX1 aspmx.l.google.com 5 alt1.aspmx.l.google.comOK
SPFv=spf1 include:_spf.google.com include:servers.mcsv.net include:sendgrid.net include:spf.shop-host.example include:spf.crm.example include:spf.helpdesk.example a mx ~all 12 of 10 DNS lookups, the most expensive first: · include:_spf.google.com: 4 · include:spf.shop-host.example: 2 · include:servers.mcsv.net: 1 · include:sendgrid.net: 1 · include:spf.crm.example: 1 · include:spf.helpdesk.example: 1 · a: 1 · mx: 1Broken
DMARCv=DMARC1; p=noneFix
DKIMselector "google"OK
MTA-STSnoneNot set
TLS-RPTnoneNot set
BIMInoneNot set
DNSSECnot signedFix

What we found

1 failed2 warnings5 passed
Show 5 passed checks

Records to add

Paste these at your DNS provider, written for Google Workspace. Changes usually show within an hour; check again after that.

  1. DMARC, next step: quarantine

    TXT record
    Name
    _dmarc.example-shop.hr
    v=DMARC1; p=quarantine; rua=mailto:[email protected]

    Publish it once your reports show all real mail passing SPF or DKIM. Forged mail then goes to spam; move to p=reject after a few quiet weeks.

  2. MTA-STS record

    TXT record
    Name
    _mta-sts.example-shop.hr
    v=STSv1; id=2026092501

    Change the id whenever the policy file changes.

  3. MTA-STS policy file

    File
    URL
    https://mta-sts.example-shop.hr/.well-known/mta-sts.txt
    version: STSv1
mode: testing
mx: aspmx.l.google.com
mx: alt1.aspmx.l.google.com
max_age: 86400

    Serve it over HTTPS with a valid certificate on the mta-sts subdomain. Switch mode to enforce and max_age to 604800 after a few clean TLS reports.

  4. TLS-RPT record

    TXT record
    Name
    _smtp._tls.example-shop.hr
    v=TLSRPTv1; rua=mailto:[email protected]

    Receivers send a daily report when they could not deliver to you over TLS.

Fix these first

From the example above. Check your own domain to get the fixes that apply to it.

  1. Problem: The SPF record has 1 problem

    A broken SPF record counts as no record at all.

    How to fix it: Remove include: entries for services you no longer use, and merge or flatten the rest until the count is 10 or less.

  2. Warning: DMARC only monitors (p=none), so spoofed mail still gets through

    p=none only collects reports; receivers still deliver mail that fails.

    How to fix it: Read the DMARC reports until every real sender passes, then set p=quarantine, and p=reject a few weeks later.

  3. Warning: DNSSEC is not enabled for the domain

    DNSSEC signs your DNS records so resolvers can reject forged answers, the attack behind hijacked websites and intercepted mail.

    How to fix it: Turn on DNSSEC at your DNS host (Cloudflare, most registrars and hosts have a switch) and, if the registrar is separate, add the DS record it gives you there.

What this tool checks

Twelve checks on the records Gmail, Outlook and Yahoo read before they decide where your email goes.

  • Mail servers (MX)

    Checks the DNS records that tell other servers where to deliver email for your domain.

  • SPF record

    Checks for the DNS record that lists which servers may send email for your domain.

  • SPF syntax and lookup limit

    Checks the SPF record parses and stays within the 10 DNS lookups receivers allow.

  • SPF catch-all rule

    Checks the end of the SPF record tells receivers what to do with mail from any other server.

  • DMARC record

    Checks for the DNS record that tells receivers what to do when mail fails SPF and DKIM.

  • DMARC policy

    Checks whether DMARC tells receivers to quarantine or reject mail that fails, or only to watch.

  • DMARC reports

    Checks DMARC names an address for the daily reports that show who sends mail as your domain.

  • DKIM key

    Looks for the public key receivers use to check that mail from your domain was not altered.

  • MTA-STS

    Checks for the policy that makes other servers use encrypted connections when they deliver mail to you.

  • TLS reporting (TLS-RPT)

    Checks for the record that asks senders to report failed encrypted deliveries to you.

  • BIMI logo

    Checks for the record that lets Gmail, Yahoo and Apple Mail show your logo next to your messages.

  • DNSSEC

    Checks your DNS answers are signed, so nobody can forge where your domain or mail points.

Show 8 more checks

  • DMARC record

    Checks for the DNS record that tells receivers what to do when mail fails SPF and DKIM.

  • DMARC policy

    Checks whether DMARC tells receivers to quarantine or reject mail that fails, or only to watch.

  • DMARC reports

    Checks DMARC names an address for the daily reports that show who sends mail as your domain.

  • DKIM key

    Looks for the public key receivers use to check that mail from your domain was not altered.

  • MTA-STS

    Checks for the policy that makes other servers use encrypted connections when they deliver mail to you.

  • TLS reporting (TLS-RPT)

    Checks for the record that asks senders to report failed encrypted deliveries to you.

  • BIMI logo

    Checks for the record that lets Gmail, Yahoo and Apple Mail show your logo next to your messages.

  • DNSSEC

    Checks your DNS answers are signed, so nobody can forge where your domain or mail points.

How it works

  1. Read your DNS

    We look up your MX, SPF, DMARC, MTA-STS, TLS-RPT and BIMI records, and try 27 DKIM selectors the big email providers use.

  2. Follow every include

    Each SPF include is followed to the end, so lookups over the limit of 10, loops and broken includes show up before receivers reject your mail.

  3. Write the fix

    Every problem comes with the record to publish, ready to paste into your DNS provider. When we recognise your email provider from its MX records, the record is written for it.

We can only find DKIM keys under common selector names. If your provider uses a custom selector, the check says "not found" even when DKIM works; the headers of a sent email show the real selector.

Questions

Is this really free?

Yes. getReport is funded by donations, not plans. You can check 20 domains every 10 minutes from one connection, and results are cached for 30 minutes.

Why do Gmail and Yahoo care?

Since February 2024 both require SPF or DKIM from every sender and DMARC from anyone who sends more than 5,000 emails a day. Microsoft followed in May 2025. Mail without them goes to spam or is rejected.

Is DMARC p=none enough?

It is the right first step, because it only reports. Once the reports show that all your real mail passes SPF or DKIM, move to p=quarantine and then p=reject, so forged mail stops reaching inboxes.

What is the SPF 10-lookup limit?

Receivers stop after 10 DNS lookups while checking SPF, counting every include, a, mx, ptr and exists, also inside included records. Past 10 the whole record fails, and so does your mail. Remove services you no longer use, or replace includes with their ip4 ranges.

Do you send an email or change anything?

No. We only read public DNS records and the public MTA-STS policy file, the same things every mail server reads when it receives your mail.

I typed my website address. Is that right?

Yes. We take the domain from a website address or an email address and drop www., because email almost always runs on the bare domain.

Related free tools

All 41 tools →

Free, funded by the people who use it

€0 of €75 this month. At €75, site crawl up to 500 pages + weekly re-check switches on for everyone.

Chip in