Email domain tools
Free online checkers for the DNS records that decide whether your mail arrives. No sign-up and no cap on how many domains you check.
Check
Email domain health check
All seven checks at once with a setup score from 0 to 100. The place to start.
Email header analyzer
Paste raw headers to see the delivery path, hop delays and why DMARC can fail while SPF and DKIM pass. Runs in your browser.
Email blacklist check
A sending address or a domain against 17 blocklists, each shown with the answer it gave, including the ones that stayed silent.
SMTP test
The real handshake with a mail server: banner, STARTTLS, certificate, reverse DNS and whether it relays third-party mail.
SPF checker
Record syntax, the expanded include chain and a counter for the ten allowed DNS lookups.
DKIM checker
Key by selector, or a probe of two dozen known ones. Key type, length and revocation.
DMARC checker
Tag-by-tag policy breakdown plus verification that external report addresses are authorised.
MX lookup
Mail servers with priorities, their IP addresses and mail provider detection.
SPF validator
Validate a pasted record before it ever goes into DNS.
Generate records
SPF generator
Build a record from your services, with verified include values and a live DNS lookup counter.
DMARC generator
Policy, subdomains, reporting and alignment, with every tag explained.
DKIM key generator
An RSA key pair created in your browser: the private half never leaves it.
BIMI generator
The record that puts your logo beside your mail, and what it demands.
MTA-STS generator
TXT record and policy file: protection against downgrading a connection to plaintext.
TLS-RPT generator
Reports about failed attempts to establish an encrypted connection.
Why these records matter
Mailbox providers decide a message's fate before they look at its content. First they check whether the sending server is authorised to use your domain (SPF), whether the message was altered in transit (DKIM), and what to do when those checks fail (DMARC). An error in any one of them sends a campaign to spam no matter how good the copy is.
The awkward part is that these records break silently. Connect a new sending platform and you cross the ten DNS lookup limit in SPF. Switch mail providers and the old DKIM selector lingers while nobody publishes the new one. Configure DMARC with reports going to an address on another domain and the reports never arrive, because that domain never authorised them. In every case the DNS panel shows green ticks.
Where to start
If this is your first look at a domain, run the full email domain health check: it fires all seven checks at once and shows you where the gap is. The individual tools are more useful once you know what needs fixing and want the detail, for example which include is eating your DNS lookup budget.
The order to configure things in
Mail authentication records depend on each other, and setting them up out of order is a reliable way to lose a week. The sequence that works: MX first, because without it the domain accepts no mail at all. Then SPF, a single record that fits inside the ten DNS lookup budget. Then DKIM, with a separate selector for every service that sends on your behalf.
Only then does DMARC make sense, and it should start at p=none with a reporting address: the reports are what reveal whoever you missed in the previous steps. Two or three legitimate senders nobody remembered almost always turn up, whether an invoicing service, the website contact form, the finance team's CRM.
MTA-STS and TLS-RPT protect the channel itself and belong after authentication works. BIMI comes last: it requires DMARC at quarantine or reject and has no effect on deliverability whatsoever.
Checkers and generators: the difference
Checkers answer the question "what does this domain publish right now". They query DNS, parse what they find and surface the errors, meaning diagnostics for a configuration that already exists, yours or somebody else's.
Generators solve the reverse problem: assembling a correct value that does not exist yet. Everything is computed in your browser, and DKIM private keys are never transmitted. The SPF validator sits apart from both, because it works on text you paste in, for checking a draft record before it goes live.
What comes after the checks
Technically correct records are a necessary condition for delivery, not a sufficient one. Providers decide a message's fate on the reputation of the domain and the IP: sending history, complaint rates, bounce rates, recipient behaviour.
Dead addresses do the most damage. A high bounce rate reads unambiguously to a provider: this sender is mailing a list they do not keep in order. So once all seven checks are green, the next step is not more DNS work, it is cleaning the list.