Email DNS Checker: MX, SPF, DKIM & DMARC

Enter a domain and optionally a DKIM selector for a server-side lookup. Record presence and the summary score do not prove mail authenticity or delivery.

View category: Network & HTTP (19)

Checksrequired · recommended · optional

How to check a domain's mail DNS records

This page reads the mail-related DNS records a domain publishes and lists them next to a checklist, so you can see at a glance which controls are in place and which record each answer came from.

The check runs live on the server for the domain you type. Nothing is stored, and the result is a snapshot of DNS at that moment, not a history or a monitoring feed.

Type the domain that sends or receives the mail, for example example.com. A bare domain is enough; there is no need to add a scheme or a trailing dot.

If you want the DKIM key checked, add the selector your provider uses (for example `google` or `selector1`). Without a selector the DKIM row stays grey and is left out of the score.

Press the check button and read the checklist: MX, SPF, DMARC and DKIM are marked required, MTA-STS and TLS-RPT recommended, BIMI optional.

Open the published records panel to see the values behind the answers, including the mail servers with their priorities and the exact TXT strings.

The seven checks, the score and what the tool cannot see

How the score is calculated

Each check carries a weight: required checks are worth 20 points, recommended checks 10 and the optional BIMI check 5. The percentage is the share of the checks that passed among the checks that could be evaluated.

Skipped checks are excluded rather than counted as failures, so a domain checked without a DKIM selector can still reach 100 when everything else passes. The letter grade follows the percentage: A from 90, B from 75, C from 55, D from 35, otherwise F.

What the check reads, and what it does not

Only published DNS records are read: MX targets, the root SPF policy, the DMARC policy under _dmarc, the DKIM key under <selector>._domainkey, the MTA-STS and TLS-RPT markers and the BIMI assertion. A DKIM record is accepted whether or not it repeats the optional v= tag, because RFC 6376 makes that tag optional and only the p= key tag required.

Nothing here sends or signs mail. Message alignment, DKIM signature validation in a real message, the MTA-STS policy file behind the DNS marker and the BIMI logo or certificate are outside this check, so a passing score means the records are published, not that every message will authenticate.

Where the lookups run

The lookups are made from the server, not from your browser. When a resolver answers with only part of a large TXT set, the same name is queried again and finally confirmed through a public DNS-over-HTTPS resolver, which is why a policy that other checkers call missing can still appear here with its exact value.

Each visit is rate limited to 30 checks per minute, and the result is shown only on this page.