Search tools

Email health check

Everything that decides whether a domain's mail is delivered or forged: MX, SPF, DMARC, DKIM, MTA-STS, reverse DNS and blacklists. Scored, with a fix for every problem. Check one domain, or all your clients' at once.

10 checks, 27 blacklists Up to 50 domains CSV and printable report Nothing stored

Summary

  • Each part's mark, once you check a domain.

Look closer

Sent from your browser, not through webdaveAsked: nothing yet

What does the email health check test?

Short answer

It reads the DNS records that decide whether a domain's email arrives and whether others can forge it: MX (who takes the mail), SPF (who may send), DKIM (signatures), DMARC (what happens to forgeries), MTA-STS and TLS reporting (encryption in transit), DNSSEC, reverse DNS of the mail servers, and 27 blacklists.

  • MX: the mail servers, the provider behind them (Microsoft 365, Google Workspace, Proofpoint, Mimecast and 35 more), and servers that do not resolve.
  • SPF: one record only, every include followed, the 10-lookup limit, lookups that find nothing, loops, +all and ?all.
  • DMARC: the policy and how much mail it covers, subdomains, report addresses, and whether outside report services have agreed to take the reports.
  • DKIM: 50 common selectors, key size, revoked keys, and whether Microsoft 365 or Google Workspace signing is switched on.
  • Blacklists: the mail servers' addresses and single servers named in SPF, against 22 IP lists, and the domain against 5 domain lists.

How the score works

Each part gets full marks when it is right, half when it works but needs attention, none when it is missing or broken. The parts are weighted by how much they matter for delivery and forgery: DMARC 25, SPF 20, MX 15, DKIM 15, blacklists 15, MTA-STS 3, DNSSEC 3, TLS reporting 2, reverse DNS 2. A grade A is 90 or more. Parts that could not be checked are left out rather than counted against the domain.

For MSPs and IT teams

Switch to Many domains and paste your client list: up to 50 domains, or email addresses, one per line. They are checked two at a time; the table fills in with each domain's score and marks, a click opens the full report, and CSV exports everything with the problems listed per domain. A single report prints cleanly for a client, with the fix for every problem.

Common findings in small business tenants: Microsoft 365 DKIM never switched on, DMARC stuck at p=none with no one reading the reports, SPF past ten lookups after years of added services, and old MX records for servers that were retired.

What Gmail, Yahoo and Microsoft require

Since February 2024 Gmail and Yahoo, and since May 2025 Outlook.com, require senders of about 5,000 messages a day to them to have SPF and DKIM, a DMARC record of at least p=none, a From address that aligns with SPF or DKIM, working reverse DNS, and a low spam complaint rate. Mail that misses these is refused or sent to spam. Smaller senders need at least SPF or DKIM.

What a browser cannot check

Browsers cannot connect to mail servers (port 25), so the server's greeting, STARTTLS, its certificate and open relays are not tested. The MTA-STS policy file is found but not read, because the policy hosts do not allow web pages to read it. Spamhaus and Microsoft's own block list cannot be asked from a browser; the blacklist part links to their lookups.

Questions

DKIM keys live at a name only the sender knows, the selector. Open a message you sent, look at its DKIM-Signature header, and type the s= value under "DKIM selector". Amazon SES and Postmark, for example, use their own long selectors.

Three records stop anyone forging it: a null MX (0 .), SPF v=spf1 -all, and DMARC v=DMARC1; p=reject at _dmarc.

Up to 50 per run. Each domain takes about 100 DNS questions (most of them blacklists), and the page paces them so the resolver and the lists are not flooded. For more, run the list in parts.

No. Your browser asks Cloudflare's resolver directly, and reports are made in the page. Nothing leaves your computer unless you copy or download it.