Email Domain Health Check

What gets checked

• MX — whether the domain receives mail, whether there is a backup server, whether the hostnames resolve.
• SPF — who is authorised to send as you, and whether the record stays within the ten DNS lookup limit.
• DKIM — whether a public key is published, how long it is, whether it has been revoked.
• DMARC — what policy applies to mail that fails authentication, and whether reports reach you.
• MTA-STS — whether connections are protected from being downgraded to plaintext.
• TLS-RPT — whether you receive reports about TLS problems.
• BIMI — whether your logo appears next to messages.

Where to start when the score is low

The weights set the order: MX first, then SPF, then DMARC. Without MX the domain receives no mail and the rest is premature. SPF takes ten minutes to configure and closes the basic spoofing case. DMARC goes in immediately in monitoring mode (p=none) and gets tightened two to four weeks later once reports have accumulated.

DKIM is usually a single switch in the mail provider's panel — it either publishes the record for you or hands you a value for DNS. MTA-STS, TLS-RPT and BIMI belong last: smaller effect, more work, and BIMI also costs money for the certificate.

What this check cannot tell you

Anything that lives outside DNS. Domain and IP reputation, complaint history, bounce rates, blocklist status, message quality. A domain with flawless records goes to spam quite happily if it spent six months mailing a purchased list.

The check also does not confirm that a DKIM signature validates on an actual message — from outside only the published key is visible. Verifying the signature itself requires the raw message with its headers.