Email health check
Find out why your email may land in spam or be faked in your name, and what to fix first. Type your domain and read the result in plain words.
- Mail server
- SPF
- SPF lookups
- DKIM
- DMARC
- MTA-STS
- TLS reporting
- BIMI
Check your email records
It reads your domain's public records from your browser. Nothing is sent to us unless you choose to send the report.
About this check
What it looks at, and what it cannot see
A first look at the records that decide whether your mail arrives and whether it can be faked.
What does each result mean?
Each line is one record your domain publishes, marked OK, Weak, Missing or Can't see, with what to do when something needs fixing.
- Mail server
- Which provider receives your mail. Without an MX record, mail to your domain has nowhere to go.
- SPF
- The list of servers allowed to send as your domain. There should be exactly one, ending in ~all or -all.
- SPF lookups
- SPF may need at most 10 DNS lookups (RFC 7208). A record that needs more is treated as broken, so the check follows every include and counts them.
- DKIM
- A signature that proves a message was not changed on the way. Its key sits under a name called a selector.
- DMARC
- Tells receiving servers what to do with mail that fails SPF and DKIM, and where to send the daily reports.
- MTA-STS, TLS reporting
- MTA-STS asks other servers to deliver your mail only over an encrypted connection; TLS reporting tells you when that fails.
- BIMI
- An optional record that can show your logo in some inboxes, once DMARC is enforced.
Why is DMARC at p=none marked weak?
Because it only watches. A policy of none asks receiving servers only to report mail that fails the checks, not to reject it, so mail faked in your name can still arrive.
It is the right place to start. Read the reports until your own mail passes, then move to quarantine and later to reject.
What can it not see?
It sees only what your domain publishes. It cannot see how your mailboxes are set up, whether mail is being faked right now, or which services send mail for you but are missing from SPF.
A DKIM key under an unusual selector stays hidden unless you give its name, and most mail servers do not let a browser read the MTA-STS policy file. When it cannot read something, it says Can't see rather than guess.
Is the domain sent to you?
No. The check runs in your browser and reads public DNS through Cloudflare's public resolver. It stores nothing and sends nothing to us. The page shows no ads.
If you want help, Send us this report puts the domain and the findings into our contact form. Nothing reaches us until you send that form.
Read more
The guides behind each finding, and the work we do when you want it fixed.
Why business email goes to spam, and how to fix it
The usual causes, in the order to check them.
Read the guide GuideSPF, DKIM, DMARC and DNSSEC, step by step
Each record, what it does and how to publish it safely.
Read the guide ServiceMicrosoft 365 and email, set up and looked after
We set up and watch the records that help other servers turn away mail faked in your name.
See the serviceWant these fixed?
Send us the report, or tell us what is going wrong with your mail. We'll tell you plainly what it takes to fix, before any work starts.