Is your domain ready to land in the inbox?
Test SPF, DKIM, DMARC, MX, BIMI and MTA-STS in one check. See exactly what is broken, how to fix it, and get alerted if it breaks again.
Try github.com or google.com · Free, no sign-up
Every check is free and needs no account.
Each check queries Cloudflare 1.1.1.1 and Google DNS-over-HTTPS when you run it. No cached reports.
Rules follow RFC 7208 (SPF), 6376 (DKIM), 7489 (DMARC), 8461 (MTA-STS) and 8460 (TLS-RPT).
DKIM key pairs are generated with Web Crypto on your device and never sent to us.
Every email authentication record, checked properly
Single-purpose checkers and generators for each record, built on the specifications rather than guesswork.
SPF checker
Lookups, includes, syntax
Open tool →SPF generator
Build a valid v=spf1 record
Open tool →DKIM checker
Keys by selector
Open tool →DKIM generator
Key pair in your browser
Open tool →DMARC checker
Policy, reporting, alignment
Open tool →DMARC generator
Create a DMARC record
Open tool →BIMI checker
Logo record and certificate
Open tool →MTA-STS checker
Policy file and TLS-RPT
Open tool →Gmail and Yahoo now enforce authentication
Since February 2024, Google and Yahoo require anyone sending more than 5,000 messages a day to Gmail to publish SPF and DKIM, a DMARC record (p=none at minimum) aligned with the From domain, and one-click unsubscribe. Every sender to Gmail needs SPF or DKIM. Broken records mean spam-folder placement or outright rejection.
Monitor my domain free| Record | Lives at | Spec |
|---|---|---|
| SPF | TXT @ | RFC 7208 |
| DKIM | selector._domainkey | RFC 6376 |
| DMARC | _dmarc | RFC 7489 |
| MTA-STS | _mta-sts + HTTPS file | RFC 8461 |
| TLS-RPT | _smtp._tls | RFC 8460 |
| BIMI | default._bimi | BIMI Group draft |
Frequently asked questions
What does the domain check test?
It looks up your SPF, DMARC, DKIM (on common selectors, or the one you enter), MX, BIMI and MTA-STS/TLS-RPT records over DNS-over-HTTPS, validates each against its RFC, and gives a 0-100 score.
Is it free?
Yes. Checks are free and need no account. Daily monitoring with email alerts is also free.
Why does DKIM say no key found?
DKIM keys live at selector._domainkey.yourdomain, and there is no way to list selectors through DNS. We try common ones; enter yours (the s= value in a DKIM-Signature header) for a definite answer.
How is the score calculated?
DMARC 30 points, SPF 25, DKIM 20, MX 10, MTA-STS 8 and BIMI 7. A pass earns full points, a warning half, a failure none.
Know the moment your email authentication breaks
We re-check your records every day and email you only when something changes. Free.