Is your domain's email set up correctly?
Enter your work email address, or just the domain. This checks the three settings that decide whether your email is delivered, put in spam, or thrown away — and whether someone else can send email pretending to be you.
Free. Runs in your browser. Nothing is sent to a server and nothing is stored.
Step 2 — send a real email and see what a receiver sees
DNS records say what should happen. This shows what actually happens. You get a one-time address on our mail server. Send it any email from the mailbox you want to test — from your normal mail program, your CRM, your newsletter tool, anything. The report shows whether SPF, DKIM and DMARC passed for that message, which server sent it, whether it was encrypted, and how a spam filter scored it.
The headers, links and images of the message are examined. The text of your email is not kept. The report is deleted after 24 hours.
What the words mean
SPF
A list of the servers allowed to send email using your domain. Other mail servers read this list to decide whether an incoming message is really from you.
SPF has one rule that catches most people out: the record is allowed to trigger only 10 DNS lookups. Each include: costs one, and each of those can open more behind it. Go over 10 and the record is invalid by the standard. What a receiver does then is not predictable: some still pass a sender that comes early in the list, others treat the whole record as an error. Your mail usually still arrives — but SPF has stopped being something you can rely on. Step 2 below shows you what actually happens.
DKIM
A signature added to every message you send. The receiving server checks the signature against a key in your DNS. If it matches, the message was not changed and it really came from your domain.
A checker cannot find DKIM on its own, because the key is stored under a name chosen by your email provider. This page tries the common names. If it finds nothing, that does not prove DKIM is missing — only that it is not under a name we know.
DMARC
Your instruction to the world: what should happen to a message that claims to be from you but fails the checks above.
p=none means "do nothing, just tell me". p=quarantine means "put it in spam". p=reject means "throw it away, do not deliver it".
No DMARC at all means anybody can send email pretending to be your company, and you will never know it happened.
MX
Where your incoming email is delivered. No MX record means the domain cannot receive email.
How this check works
Step 1: your browser asks Google's public DNS service for the records on the domain you type. The answers are read here, in the page. There is no server behind it, no account, no log, and no list of the domains people check.
Step 2: the test address belongs to our own mail server. When your email arrives, the server reads the headers — who sent it, from which IP, whether SPF, DKIM and DMARC passed — asks the public blocklists about the sending IP and the domain, scans the body for links and images, runs two independent spam filters (Rspamd and SpamAssassin), writes all of that into a small report, and throws the message away. The text of your email is never stored. The report disappears after 24 hours.
Everything it reads is public. Anyone can look up these records for any domain. That is the point of them — they exist so that other mail servers can read them.
A pass here does not guarantee your email reaches the inbox. Authentication and reputation are two different things. This page checks the first one.
If it found something and you want it fixed
I'm Bill. I build and run software and the servers under it, and email authentication is part of that. If the check found a problem you'd rather hand to someone, write to me and say which domain — I'll tell you what it would take.