Domain health checker

• SPF: whether a record exists, whether there is more than one (an error), how it ends, and how many of the ten permitted DNS lookups it uses once every include is followed.
• DKIM: whether a public key is published on common selectors (google, selector1, selector2, default, k1, mail) or on the selector you enter.
• DMARC: the policy, subdomain policy, percentage, alignment mode and report address, each explained.
• MX: whether the domain can receive mail, which receivers expect of a domain that sends it.

OK means the record is present and correctly formed. Needs attention means it works but has a gap worth closing, such as DMARC at p=none with no report address, or SPF close to its lookup limit. Problem means receivers are likely to treat your mail as unauthenticated.

A clean result means your domain is set up correctly. It does not guarantee the inbox: receivers also weigh how recipients respond to your mail. The bulk sender requirements cover the rest.

• DKIM keys can live on any selector name. If yours is not one of the common ones and you do not enter it, the result may say no key was found when one exists.
• It reads public DNS through Cloudflare's resolver, so a record you changed minutes ago may not show until caches expire.
• It checks DNS only. It does not send a test message or look up blocklists.

The domain is looked up and the result shown to you. The domain itself is not stored, and no account or email address is asked for. We count that a check ran and its overall score, with nothing identifying you or the domain. Checks are rate-limited per network to keep the tool available.

• SPF, DKIM and DMARC: what each one actually proves
• SPF's 10-lookup limit and how to fix it
• DMARC alignment explained