Mail diagnostics · live, no sign-up
Email diagnostics, explained
Check how a domain is set up for e-mail. Every result comes with what it means and what to do about it, not just PASS or FAIL.
- 16free tools
- 7DNS checks
- 4active blocklists
- 7guides
- 0cookies
The path of an e-mail
- The sendersends a message to your domain
- Email DNS checkMX, SPF, DKIM, DMARC: where to, and who may send
- Blacklist checkwhether the address is on blocklists
- SMTP server checkbanner, STARTTLS, certificate, reverse DNS
- Header analyzerthe route, delays and verdicts, read from the message
- The recipient's inboxthe message arrives, or not, and you see why
Tools
-
Email DNS check
MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI of a domain, each explained.
- MX
- SPF
- DKIM
- DMARC
- MTA-STS
- TLS-RPT
- BIMI
-
DNS lookup
Any record of a name: A, AAAA, MX, TXT, NS, SOA, PTR, CAA, SRV, with TTL, the CNAME chain and DNSSEC validation.
- A
- AAAA
- MX
- TXT
- NS
- SOA
- PTR
- CAA
- SRV
-
Blacklist check
Is an IP or domain listed on public DNS blocklists?
- A/AAAA
- MX
- DNSBL
- RFC 5782
-
Header analyzer
Paste a message's headers: route, delays and authentication results.
- Received
- SPF
- DKIM
- DMARC
- ARC
- X-Spam
-
SMTP server check
Banner, EHLO, STARTTLS, certificate and reverse DNS of each MX.
- Banner
- EHLO
- STARTTLS
- TLS
- PTR
- FCrDNS
-
SMTP error codes
Paste a bounce or look up a code like 550 or 5.7.26: what it means, how Gmail and Microsoft 365 use it, what to do.
- 550
- 5.7.26
- RFC 3463
- DSN
- Gmail
- Microsoft 365
-
Mail delivery test
Send a message to a test address and see what the receiving server sees: SPF, DKIM, DMARC, reverse DNS, blacklists, TLS.
- SPF
- DKIM
- DMARC
- PTR
- DNSBL
- TLS
-
SPF generator
Tick the services that send mail for your domain and get the SPF record, checked live.
- include
- ip4/ip6
- a/mx
- ~all/-all
- RFC 7208
-
SPF tree
An SPF record's whole include and redirect chain, with DNS lookups counted as a receiver counts them and where the limit of 10 is crossed.
- include
- redirect
- 10 DNS lookups
- void lookups
- RFC 7208
-
DNS propagation
The domain's DNS servers asked directly: do they all give the same answer and serial, and do resolvers still hold the old answer?
- NS
- SOA serial
- TTL
- AA
- RFC 1034
- RFC 1912
-
Domain monitoring
Get an e-mail when your domain lands on a blacklist, when SPF, DKIM or DMARC break, or when the mail server's certificate is about to expire.
- DNSBL
- SPF
- DKIM
- DMARC
- MTA-STS
- TLS
-
DMARC generator
Policy, reports and alignment: the DMARC record ready to publish, with its report destinations checked.
- p=
- rua/ruf
- adkim/aspf
- pct
- RFC 7489
-
DMARC report analyzer
Upload the aggregate reports you receive (XML, .gz, .zip): who sends in your domain's name, what passes and what fails.
- XML
- .gz
- .zip
- rua
- RFC 7489
-
DKIM generator
A DKIM key made in your browser, with the TXT record to publish and a check of it in DNS. The private key never reaches the server.
- RSA 2048
- Ed25519
- selector
- WebCrypto
- RFC 6376
-
MTA-STS generator
The policy file, the _mta-sts record and TLS-RPT, checked against the domain's MX hosts.
- mode
- mx
- max_age
- TLS-RPT
- RFC 8461
-
TLS report analyzer
Upload the TLS-RPT reports you receive (JSON, .gz, .zip): which TLS deliveries to the domain failed, on which MX and why.
- JSON
- .gz
- .zip
- rua
- RFC 8460
How it works
Lookups go through our own validating resolver, so blocklists and DNSSEC answers are what a mail server would see.
When a lookup fails we say so: a timeout is reported as unavailable, never as a pass.
Every result has its own link and a plain-text copy for tickets. We do not store what you check.
Guides
- Email DNS records: MX, SPF, DKIM and DMARC explained What MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI records do, how receiving servers read them, and the mistakes that break delivery.
- DNS blocklists: how they work and how to get delisted How DNS blocklists (DNSBLs) answer, what their return codes mean, why a check can come back "unavailable", and what to do when your IP is listed.
- How to read email headers: route, delays, SPF, DKIM How to read a message's headers: the Received route and its delays, Authentication-Results for SPF, DKIM and DMARC, ARC, and anti-spam fields.
- Testing an SMTP server: banner, STARTTLS, certificate What an SMTP server check looks at: the greeting, EHLO capabilities, STARTTLS, TLS version, the certificate and reverse DNS, and why each one matters.
- DMARC step by step: from p=none to reject How to publish DMARC without losing mail: reports, SPF and DKIM alignment, subdomains, pct and moving gradually from p=none to quarantine and reject.
- MTA-STS and TLS-RPT: enforce TLS without losing mail How to publish MTA-STS and TLS-RPT step by step: the policy file, the DNS records, hosting, testing mode, the TLS reports and moving to enforce.
- Why emails go to spam and how to fix it The technical reasons mail lands in spam: SPF, DKIM, DMARC, reverse DNS, blacklists, TLS, the header and unsubscribing, each with its test and its fix.