Mail Server Check
Domain to check
MX, SPF, DMARC and DKIM, then the reputation of every mail server address.
Mail setup for
-
MX Records
Where this domain receives mail.
SPF
Which servers may send as this domain.
DMARC
What receivers do with mail that fails.
DKIM
Signing keys found for common selectors.
Blocklist Status
Domain blocklists, plus every mail server and web address behind the domain.
Notes
How to read this result.
Nothing checked yet
Enter a domain to see whether its mail records are published, valid and aligned.
What a receiver checks before your mail lands
Modern receivers run a short checklist on every inbound message. The domain must have an MX record pointing at a host that accepts mail. SPF must authorise the sending server. DKIM must show the message was signed and unaltered. DMARC must tie SPF or DKIM to the visible From header. Reputation decides what happens after that.
Failing one check does not block delivery on its own. Failing several at once, with no reputation, sends mail to the spam folder or rejects it outright.
SPF: the ten lookup limit
SPF allows at most ten DNS lookups per evaluation. The mechanisms include, a, mx, ptr, exists and the redirect modifier all count. Nested includes count again, so one include of a provider that includes two others costs three.
Exceeding ten returns a permanent error, which receivers treat as a fail. A domain that worked for years can break when a provider adds a subdomain to its own SPF record. Check the count whenever you add a sending service.
Two SPF records on one domain is also a permanent error. Merge them into a single record with one all mechanism at the end.
DMARC policies and what each one does
| Policy | Effect |
|---|---|
p=none | Monitor only. Reports arrive, nothing is blocked. The right starting point. |
p=quarantine | Failing mail goes to the spam folder. |
p=reject | Failing mail is refused outright. Stops domain spoofing. |
pct=25 | Applies the policy to a percentage of mail. Useful when rolling out. |
rua=mailto: | Where aggregate reports go. Read these before tightening the policy. |
Start at p=none with a rua address, read two weeks of reports to find legitimate senders you forgot, then move to quarantine and finally reject.
Why DKIM may be reported as missing
DKIM keys live at selector._domainkey.domain, and the selector is chosen by the sender. Nothing in DNS lists the selectors in use, so a lookup tool has to guess. Common names include default, google, selector1, k1 and s1, and this tool tries the usual set.
A randomised or vendor-specific selector will not be found and the result is a false negative. If the check reports DKIM missing but your provider says it is configured, read the selector from a real signed message header and verify that name directly.
Frequently asked questions
Do I need all three: SPF, DKIM and DMARC?
You need SPF and DKIM for authentication, and DMARC to tell receivers what to do when both fail. Missing DMARC leaves spoofed mail deliverable.
Why did my SPF suddenly start failing?
The ten lookup limit is the usual cause. A provider added an include to its own record, pushing your total over the limit and producing a permanent error.
Is p=none useful?
Yes, as a monitoring stage. It changes nothing about delivery but sends reports that reveal every service sending mail as your domain. Move to a stricter policy once the reports are clean.
Why does the check say DKIM is missing when it works?
The selector cannot be discovered from DNS. If yours is not one of the common names, the check cannot find it. Verify the exact selector from a signed message header.
Does this test send an email?
No. Every result comes from DNS and blocklist queries. Nothing is delivered anywhere.
What does a failing grade mean?
At least one target is listed on two or more blocklists, or authentication is broken. The notes name the specific check that failed.