Email Health Check
Check your domain's email authentication configuration. Analyze MX, SPF, DKIM, and DMARC records.
How this tool works
Use these details to understand what the result measures, what it can miss, and how DNS Kit handles the query.
Data source
Quick Check reads MX, SPF, DKIM and DMARC records and applies DNS Kit’s configuration checks. Deep Scan adds SMTP connectivity, STARTTLS, blacklist and DNS-health tests against the mail infrastructure visible during that run.
Caching and freshness
DNS portions can reflect recursive resolver caches and published TTLs. SMTP, TLS and blacklist observations are point-in-time tests; providers, blocklists and network paths can change after the scan.
Privacy and retention
The domain is sent to DNS Kit, DNS resolvers and, during Deep Scan, relevant mail servers and blacklist services. Aggregate API usage stores a SHA-256 domain hash and coarse country for up to 90 days. Visible inputs and results may appear in website session replay.
How to interpret the result
The score summarizes the checks shown in the result; it is diagnostic guidance rather than a delivery guarantee. Review each MX, SPF, DKIM and DMARC finding separately, because receiving providers apply their own authentication and filtering policies.
Worked example
A domain can score well with valid SPF and DKIM but still show a DMARC warning when no policy record is published. Fix the named control, then rerun after its DNS TTL has elapsed.
Limitations
- DKIM cannot be exhaustively discovered because selectors are chosen by the sender; test the selector used by your mail provider.
- A reachable SMTP server or advertised STARTTLS does not guarantee inbox placement or successful delivery.
- Blacklist results are provider-specific snapshots and can change independently.
Frequently asked questions
- What is an email health check?
- An email health check analyzes your domain's email authentication records (MX, SPF, DKIM, DMARC) to verify they're correctly configured for secure email delivery.
- What is SPF?
- SPF (Sender Policy Framework) is a DNS record that specifies which mail servers are authorized to send email on behalf of your domain, helping prevent email spoofing.
- What is DKIM?
- DKIM (DomainKeys Identified Mail) adds a digital signature to outgoing emails, allowing recipients to verify the email hasn't been tampered with and comes from an authorized sender.
- What is DMARC?
- DMARC (Domain-based Message Authentication, Reporting & Conformance) tells receiving servers what to do with emails that fail SPF or DKIM checks, and provides reporting on authentication results.
- What does a good email health score mean?
- The score summarizes completed checks. A high score can still need review: read the findings for missing records, configuration problems, and checks that could not finish. Finding DNS records does not guarantee email delivery.