Free email health check
SPF, DKIM and DMARC checker: one domain, one grade
Check MX, SPF, DKIM, and DMARC together. Get a plain-English score, the problems that matter first, and links to the exact diagnostic for each one.
How the email health grade is calculated
The 100-point score rewards four foundations: working MX records (20 points), a published and structurally valid SPF record (25), a discoverable DKIM public key (25), and DMARC publication, reporting, and enforcement (30). Missing or broken foundations lose their points; warnings stay visible even when a check earns partial credit.
Results are ordered by severity, so the first red item is usually the place to start. Each finding links to a focused checker that exposes the raw record and the detail needed to fix it. Nothing is hidden behind an email form.
The grade deliberately stays within what public DNS can prove. It does not claim to measure reputation or promise inbox placement, and a DKIM warning is not treated as conclusive because selectors cannot be enumerated from DNS.
What SPF, DKIM and DMARC each prove
The three records answer different questions, which is why a checker that reads only one of them can leave you with a false sense of safety. SPFlists the servers allowed to send mail for your domain. A receiver compares the connecting server's IP with that list, but only for the hidden envelope sender (Return-Path), not the From address people see.
DKIM is a signature. Your sending service signs each message with a private key, and publishes the matching public key in DNS under a selector such as selector1._domainkey.example.com. A valid signature proves the message was not altered and that the signing domain approved it.
DMARC ties the two to the visible From domain. A message passes DMARC when SPF or DKIM passes and the domain that passed matches (aligns with) the From address. The DMARC record then tells receivers what to do with mail that fails, and where to send reports. MX is included here because a domain that cannot receive mail breaks replies, bounces and many verification flows.
How to read your results
Findings are listed with the most serious first. The ones you are most likely to see:
- No SPF record, or two of them. Receivers treat duplicate SPF records as a permanent error, so two records is effectively the same as none. Merge them into one TXT record that starts with
v=spf1. - SPF over 10 DNS lookups. Every
include:,a,mxandredirectcosts lookups, and nested includes count too. Past ten, SPF returns a permerror and stops protecting you. The SPF checker shows the full chain. - No common DKIM selector found.This is a warning, not proof DKIM is missing, because selectors cannot be listed from DNS. Look up your provider's selector in the DKIM checker, or send a message to the email deliverability test to see the signature itself.
- DMARC at p=none with no rua= address. The record exists but nobody is watching. You get neither protection nor visibility. Add a report address first, then plan the move to quarantine.
- No MX records. Fine for a send-only subdomain, a problem for a domain people reply to.
A safe order for fixing what the check finds
- List every service that sends as your domain: your mailbox provider, newsletter tool, CRM, billing, help desk and anything that sends password resets.
- Make sure each one is either in your single SPF record or signs with DKIM on your domain. DKIM is the sturdier of the two because it survives forwarding.
- Publish DMARC at
p=nonewith arua=address. The DMARC record generator builds a valid record in a minute. - Read the aggregate reports for two to four weeks. Any legitimate source that fails is something to fix before you enforce.
- Move to
p=quarantine, thenp=reject, and run this check again after each DNS change.
Since February 2024, Gmail and Yahoo require SPF or DKIM for all senders, and SPF, DKIM and a DMARC record for anyone sending in bulk. The bulk sender requirements guide covers the details.
When a one-off check is not enough
A clean grade today says nothing about next month. Records break quietly: someone adds a new tool and a second SPF record, a DNS migration drops the DKIM key, a provider rotates a selector. You usually find out from a customer who says your invoice went to spam.
HealthCheck Email can watch your domain every day and alert you when a record changes, and it parses your DMARC reports so you can see which services send as you. Monitoring is free for one domain. The checker on this page stays free and needs no account either way.
Common questions
What does an email health check test?+
This check reads the public DNS records that support business email: MX for inbound routing, SPF for authorized senders, common DKIM selectors for signing keys, and DMARC for alignment, reporting, and spoofing policy. It then combines those findings into one weighted grade.
Does a high score guarantee my email reaches the inbox?+
No. Authentication and routing are essential foundations, but inbox placement also depends on sending reputation, complaint rates, content, engagement, list quality, sending volume, and whether each real message is authenticated correctly. Use the inbox test and header analyzer to inspect an actual message.
Why can the DKIM result say no common selector was found?+
DKIM selectors are chosen by each email provider and there is no public index of them. The scanner probes common names, so finding a key is conclusive, while finding none is only a warning. Check your provider's exact selector or send a real message to the inbox test before deciding DKIM is missing.
Is it safe to check someone else's domain?+
Yes. DNS email records are public by design so receiving mail systems can use them. The checker reads only those public records and does not log in, send mail, or change the domain.
How often should I check my email setup?+
Run a check after changing DNS, adding or removing a sending service, migrating email providers, or seeing new delivery failures. Because records can break later without warning, continuous monitoring is more reliable than remembering to scan manually.
More free checks