Email Health Checker

Enter a sending domain or email to query public MX, SPF, DMARC, MTA-STS, and TLS-RPT DNS records. Enter a real DKIM selector to check corresponding public key records; enter actual sending public IP to check PTR and public reputation status. Each item shows query evidence, status, and recommendations, supporting JSON and text report downloads. DNS checks do not replace actual email authentication or inbox delivery testing.

SPF checks focus on record count, syntax, and recursive DNS queries within limits. DKIM requires supplying the selector actually used by the sending system—having a public key in DNS does not guarantee an individual email signature is valid. DMARC checks records and domain policies, without directly validating SPF/DKIM alignment for a specific message. Complete validation requires recipient email headers and actual email samples. Please verify all authorized sending services before modifying records.

Check domain verification settings in your email provider or locate the s= value in the DKIM-Signature header of sent raw emails. A d= signing domain is usually included; the selector must match that domain for lookup. The tool will not enumerate or guess selectors; if unprovided, it shows undetected rather than missing. Supports entering up to three single-label DNS selectors at once.

No. Public DNS blacklists provide only partial reputation clues, and results are subject to query conditions, authorization, resolvers, and service limits. Not being listed on a public blacklist does not guarantee inbox delivery; recipient private blocklists, personal rules, and spam filters cannot usually be queried publicly. When services are unavailable or queries are rejected, status is shown as unknown rather than unlisted.

Access official Postmaster Tools using a Google account, add your actual sending domain, and complete verification. It provides metrics like spam rate for emails sent to personal Gmail accounts, domain/IP reputation, authentication, encryption, and delivery errors, but does not cover all inbox providers. Integrating these private metrics in the backend requires domain permissions and Google OAuth authorization; public single checks will not read your Gmail messages.

Low sending volume, privacy thresholds, reporting delays, unverified domains, or lack of traffic to personal Gmail accounts can result in missing data. Missing data does not mean a zero spam rate or a good domain reputation. Verify your sending domain, Google permissions, and reporting dates first, then troubleshoot according to official Google guidelines.

No. MX records specify receiving servers, while PTR reverse records are typically managed by the provider for the actual sending IP. A recipient server's IP may be completely different from the sending IP, so the tool will not treat resolved MX addresses as sending IPs. Please verify the real public sending IP from your email provider, email headers, or self-hosted mail server configuration.

SPF directives such as include, a, mx, exists, and redirect may trigger DNS lookups, which are subject to RFC lookup limits. This tool also enforces a maximum lookup count and execution time limit; if temporary DNS errors occur or limits are reached, the check will be marked as incomplete. Final SPF evaluation for complex dynamic rules and specific email identities should still be performed by the receiving email system.

p=none can be used to collect reports and monitor authentication status, and shouldn't be simply judged as an error. Whether to upgrade to quarantine or reject depends on SPF/DKIM alignment, forwarding, and business needs for each sending service. The tool explains policies without advising blind changes to strict policies, avoiding impact on legitimate business emails.

Backend corporate email management provides health inspections and configuration for existing notification channels. Verify actual sending domains, DKIM selectors, and sending IPs before enabling inspections and selecting notification channels. Public configuration anomalies and recoveries can be included in alerts; Gmail private reputation metrics require additional domain verification and authorization. Inspections do not automatically modify DNS or send delivery test emails on your behalf.

The browser first extracts and displays the domain name. A single DNS check submits only the domain name, optional DKIM selector, and sender public IP, without submitting the mailbox local part, password, or email content. Reports are not saved persistently in the browser by default; downloaded files will contain the checked public domain and sender IP. The page retains site ads, and testing requires access to network services.