Email Health Checker

An email domain is considered healthy when it can receive mail, has authentication records proving senders are legitimate, and is not associated with disposable or throwaway providers. These factors collectively determine how much trust mail servers and spam filters extend to messages from that domain. And therefore whether they reach the inbox or the spam folder. This tool audits all five dimensions simultaneously using live DNS-over-HTTPS lookups and returns a weighted score out of 100 with an A-F grade.

The five checks cover the complete picture. MX records confirm the domain has an active mail server capable of receiving email. Without MX records, every message sent to that domain bounces permanently. SPF (Sender Policy Framework, check yours here) defines which servers are authorised to send on the domain's behalf. DMARC (check yours here) specifies what receiving servers should do when SPF or DKIM fails. None (monitor), quarantine (spam), or reject (block). DKIM (analyze yours here) verifies email has not been altered in transit using a cryptographic signature. And the disposable domain check flags known temporary inbox providers that are unsuitable for commercial email.

Each check returns a specific score contribution, a plain-English result, and where relevant a targeted fix tip. This means the tool does not just grade your domain. It tells you exactly which DNS records to add or change to improve the score, ranked by impact. Since February 2024, Google and Yahoo require bulk senders to have valid SPF, DKIM, and a DMARC record in place. This health check confirms compliance with those requirements at a glance.

Most domain owners configure email once and never revisit it. But email infrastructure is not static. Sending services are added, DNS records are accidentally overwritten, and provider requirements change. A domain that scored Grade A two years ago may now have a broken SPF record from a DNS migration, a DMARC policy stuck at p=none from an initial setup that was never advanced, or a DKIM key that has been silently revoked. None of these failures announce themselves. Email continues to send but lands in spam or gets rejected at the most security-conscious receivers.

The health score makes the gap between configuration intent and actual DNS state immediately visible. A score of 68/100 does not mean "mostly fine". It typically means DMARC is at p=none (providing zero enforcement) and DKIM has not been verified, which together mean spoofed email from your domain faces no authentication barrier at most receiving servers. Moving from Grade C to Grade A usually requires two or three targeted DNS changes, each of which takes under five minutes once identified.

For email marketers, SaaS founders, and anyone sending transactional email, this check is the fastest way to confirm compliance with the Google and Yahoo 2024 bulk sender requirements: valid SPF, DKIM signing, and a DMARC record are all mandatory for senders delivering more than 5,000 messages per day to Gmail. The health checker surfaces all three gaps in a single run. Even for lower-volume senders, these settings are increasingly a baseline deliverability signal. Inbox providers use them to score sender reputation before evaluating content at all.

For security teams, the disposable domain check and authentication audit together identify two distinct risk vectors: inbound (disposable addresses that should not be accepted in signup flows or CRMs) and outbound (domains with weak or missing authentication that are easy to spoof in phishing campaigns). Running this check across your domain portfolio, including acquired, legacy, and parked domains, takes seconds per domain and surfaces the highest-priority security gaps.

Most domains below Grade B have one or two specific issues that account for the majority of lost points. Here is what each common failure means and how to fix it.

MX records are the routing layer. When any mail server anywhere in the world tries to deliver email to your domain, it queries DNS for MX records to find which server should receive the message. Without MX records, there is nowhere to route the email. It bounces immediately with a permanent error. For non-sending domains, a null MX record (priority 0, value '.') explicitly signals no inbound mail is accepted, which is cleaner than having no MX at all.

SPF (Sender Policy Framework) is the sender authorisation layer. Published as a TXT record at your root domain, it lists every IP address and mail service authorised to send email on your behalf. When a receiving server gets a message claiming to be from your domain, it checks whether the sending IP is in your SPF record. The all qualifier at the end determines the penalty for unauthorised senders: -all rejects them, ~all flags them, +all passes them (insecure). If your SPF record has too many include: chains and is approaching the 10-lookup RFC 7208 limit, the SPF Flattening Tool resolves all includes to direct IP ranges. You can also use the SPF Record Checker for a detailed mechanism-by-mechanism breakdown.

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is the enforcement and reporting layer. It sits on top of SPF and DKIM and adds two things neither standard provides individually: alignment (the From: header domain must match the authenticated domain) and policy (what to do when alignment fails). It also enables daily XML aggregate reports from major mailbox providers showing pass/fail rates across all your sending sources. Use the DMARC Checker for a health summary or the DMARC Analyzer for a full tag-by-tag breakdown.

DKIM (DomainKeys Identified Mail) is the signing layer. It adds a cryptographic signature to outgoing messages using a private key, while the corresponding public key is published in DNS. Receiving servers use the public key to verify the signature. Confirming the message was not altered in transit and genuinely came from an authorised source. Unlike SPF, DKIM signatures survive email forwarding, making DKIM the more reliable alignment mechanism for third-party ESPs. Use the DKIM Analyzer to inspect your key strength, check for revoked keys, and detect test mode.

Disposable domain detection identifies known temporary email services. This matters for two distinct use cases: marketers and product teams who need to filter throwaway addresses from signup forms and email lists, and security teams auditing whether an email address belongs to a verifiable organisation or a temporary inbox designed to avoid contact follow-up. The check queries two independent sources, Kickbox's open API and a community-maintained GitHub blocklist, and returns a positive flag if either source identifies the domain.