Email health check
Run every email check on a domain at once and get a short report, with the most important fix first and links to the full results.
Running the Health Check. This can take up to 30 seconds.
Choosing a check opens its page. With the keyboard, use the arrow keys, then press Enter.
How the Email Health Check works
Enter a domain and we run each email check from our server, one after another, then show a short report with the most important fix first. Each part links to the full check.
- Mail servers (MX): where the domain receives email, or a null MX if it takes none.
- SPF: which servers may send as the domain, and the limit of 10 DNS lookups.
- DMARC: the policy receivers apply when SPF and DKIM fail, and where reports go.
- DKIM: signing keys at 8 common selectors.
- BIMI: a brand logo for supporting inboxes.
- MTA-STS: the DNS record and the policy file that ask senders to use verified encryption.
- TLS-RPT: where reports about failed encrypted delivery go.
- DNSSEC: whether the domain's DNS answers are signed.
Reading the report
Each part shows the same verdict as its own check. Attention means something may cause problems or an important record is missing. Informational means an optional feature isn't set up, which is often fine. Results are saved for 5 minutes, and recent results of the single checks are reused.
To fix SPF or DMARC, our SPF Record Generator and DMARC Record Generator build a correct record for you.
Frequently asked questions
What does the Email Health Check look at?
The DNS records that decide whether your email arrives and can be trusted: mail servers (MX), SPF, DMARC, DKIM, BIMI, MTA-STS with its policy file, TLS-RPT and DNSSEC. It doesn't send or receive email, and it doesn't connect to your mail servers.
How is DKIM checked without a selector?
We try 8 common selectors: google, selector1, selector2, k1, s1, s2, default and dkim. Selectors can be any name, so "none found" doesn't mean the domain has no DKIM. Use the DKIM Checker with the selector from a sent message to be sure.
Which problem should I fix first?
The report lists failures first, then warnings, in this order: mail servers, SPF, DMARC, DKIM, BIMI, MTA-STS, TLS-RPT and DNSSEC. Mail servers, SPF, DMARC and DKIM matter most for delivery; the others add protection or branding.
Why does a part say "Unable to determine"?
That part couldn't be checked reliably this time, for example because a DNS server didn't answer or the whole check reached its 30-second limit. The other parts are still shown. Try again in a minute, or open the full check for that part.
Guides about this tool
-
Email
Email health checklist: what to check before you send
The DNS records and other checks that decide whether your email is trusted, from MX, SPF, DKIM and DMARC to reverse DNS, BIMI, MTA-STS and DNSSEC.
Related tools
-
SPF Record Generator
Build one SPF record for your domain from the services that send your email. We check it the way receivers do, including the limit of 10 DNS lookups.
-
DMARC Record Generator
Build a DMARC record for your domain: choose what receivers should do with mail that fails, and where to send reports. We check it before you publish.
-
Website Health Check
Run the main website, DNS and email checks on one site at once and get a short report, area by area, with links to the full results.
-
DNS Lookup
Look up the DNS records published for a domain, one type or all common types at once, or the reverse DNS name of an IP address.