One report on a domain’s mail servers, SPF, DMARC, DKIM, DNSSEC and blocklists
Runs in your browser. Only the lookup you start is sent to cloudflare-dns.com or dns.google; nothing else leaves your device. Updated on 24 Oct 2026.A domain health check runs 9 checks on one domain together: mail servers, SPF, DMARC, DKIM, BIMI, MTA-STS with TLS-RPT, DNSSEC, blocklists for the mail servers' addresses, and the NS and SOA records. Each line is marked pass, warn, fail or info, and the totals are counts, not a score.
Type a domain, or an email address at that domain, into Domain or email address and press Check.
Watch the progress bar count the checks finished, from Mail servers to Basic DNS (NS and SOA).
Read each section’s Pass, Warn, Fail and Info lines; each Full check link opens the detailed tool.
Press Copy report as text to share the whole report.
Type a domain, or paste an email address, press Check, and this page runs the site's email and DNS checks one after another in a single report. Nothing runs until you press the button. The checks are the same code as the separate tools, so a line here and the full tool always agree, and each section links to that tool for the detail.
What the report covers:
Some things it cannot know, and it says so. DKIM keys sit under a selector name that only a real message reveals, so the page tries 9 common names and labels them as guesses; not finding one proves nothing. Spamhaus, Barracuda and UCEPROTECT do not answer public resolvers or do not allow this use, so they are not checked. The page reads DNS only: it does not connect to the mail servers, so it cannot test SMTP, STARTTLS or certificates.
The totals at the top are counts of fails, warnings and passes. There is no weighted score, because no standard says how much a missing BIMI record weighs against a blocklisting.
The domain you type, and the record names and addresses the checks look up from it, are sent to the public resolver you choose, Cloudflare or Google. Nothing else leaves your device, and no account is needed.
Nine things for one domain: its mail servers (MX), SPF, DMARC, DKIM on common selectors, BIMI, MTA-STS with TLS reporting, DNSSEC, the mail servers' IPv4 addresses on five public blocklists, and the name servers and SOA record. Each result is one line marked pass, warn, fail or info, with a link to the full check.
A DKIM key lives under a selector name chosen by whoever sends the mail, and only the DKIM-Signature header of a real message shows it. The report tries nine common names such as google and selector1. Those are guesses, so a miss proves nothing; the DKIM Checker looks up the exact selector.
No weighted score. The top line counts the fails, warnings and passes in the report, and nothing more. No standard says how much a missing BIMI record should weigh against a blocklisted server, so any single number would be invented. Read the fails first, then the warnings.
SpamCop, PSBL and three 0spam lists, for every IPv4 address of the domain's mail servers, up to eight addresses. Spamhaus refuses queries sent through public resolvers, and Barracuda and UCEPROTECT do not allow this use, so they are not checked here. Their own websites check an address for free.
Only to the public resolver you choose, Cloudflare at cloudflare-dns.com or Google at dns.google, together with the record names and mail server addresses the checks look up from it. The lookups run in your browser; this site never receives the domain, and nothing else leaves your device.
Not fully. The report reads what a domain publishes in DNS, which is what most spam filters check first. It cannot send a test message, open an SMTP connection, see STARTTLS or certificates, or know a mailbox provider's own reputation score for the sender, so a clean report is necessary but not sufficient.
Still stuck? Ask about Domain Health Check and anybody who knows can answer. No account needed.
Also works as: Email Health Report · Email Deliverability Checker.
Same job, other tools: SPF Record Generator – Write an SPF record for your mail providers and see how many lookups it uses · DMARC Record Generator – Build a DMARC record step by step, from p=none reporting to p=reject · Find the Sender IP of an Email – Paste the headers of an email to find the IP address of the server that sent it.