EN
Sign inRequest access
Menu

Email domain checker

Check the MX, SPF, DKIM and DMARC records of any domain in one go. Type a domain or an email address: you get one line per record, marked pass, warning or fail, in plain language, and the record to publish for each problem. Free, with no sign-up.

We read public DNS records only. If you type an email address, only the part after @ leaves your browser.

Report for lumen-advisory.example

This is an example for a made-up domain. Type your own domain above to check it.

2 of 4 checks pass. Fix SPF first.

DNS for this domain is managed at Cloudflare. Make the changes there.

  • MXMail for this domain goes to Google Workspace at smtp.google.com.Pass

    MX records tell other mail servers where to deliver mail for your domain, including replies to your messages. The lowest number is tried first.

    What we found

    1 smtp.google.com
  • SPF2 SPF records found, so SPF fails for all mail from this domain.Fail

    Receivers read exactly one SPF record. When they find more, they stop with a permanent error, which counts as no SPF at all.

    What we found

    v=spf1 include:_spf.google.com ~all
v=spf1 include:mail.webhost.example -all

    How to fix it

    Delete the 2 SPF records and publish this one in their place. It keeps every service the old records named.

    Type
    TXT
    Name
    lumen-advisory.example
    Value
    v=spf1 include:_spf.google.com include:mail.webhost.example -all

    Publish it as a TXT record at lumen-advisory.example, in place of any SPF record already there. This record uses 2 of the 10 DNS lookups SPF allows.

    Many DNS panels want only the part before your domain: @ for the domain itself, _dmarc for DMARC.

  • DKIMA 2048-bit DKIM key is published at google._domainkey.Pass

    Receivers use this key to confirm that a message was signed for your domain and was not changed on the way.

    What we found

    google._domainkey.lumen-advisory.example
  • DMARCDMARC is set to p=none, so mail that fails the checks is still delivered.Warning

    p=none meets the minimum that Gmail and Yahoo ask of bulk senders, but anyone can still send mail as your domain.

    • No reports address (rua), so you will not hear about mail that fails.

    What we found

    v=DMARC1; p=none

    How to fix it

    Replace it with this record, which adds a reports address.

    Type
    TXT
    Name
    _dmarc.lumen-advisory.example
    Value
    v=DMARC1; p=none; rua=mailto:dmarc@lumen-advisory.example

    Publish it as a TXT record at _dmarc.lumen-advisory.example, in place of any DMARC record already there.

    Reports go to dmarc@lumen-advisory.example. Create that mailbox, or change the address to one you read.

    Many DNS panels want only the part before your domain: @ for the domain itself, _dmarc for DMARC.

Each record answers one question that a receiving server asks.

MX Where does mail for this domain go?
MX records name the servers that receive mail for your domain. Without them, replies to your messages bounce.
SPF Which servers may send as this domain?
SPF is one TXT record that lists the services allowed to send for you. Receivers allow at most 10 DNS lookups while reading it.
DKIM Was the message signed by this domain?
DKIM adds a signature to each message, and receivers check it against a public key in your DNS. It still works when mail is forwarded.
DMARC What happens when the checks fail?
DMARC tells receivers whether to deliver, quarantine or refuse mail that fails SPF and DKIM, and where to send reports.

Each line of the report is a pass, a warning, a failure or a check that could not run.

Pass
The record is in place and does its job.
Warning
It works but is weaker than it should be: for example DMARC at p=none, a 1024-bit DKIM key, or no DKIM key under the common selectors. Fix it before you send more.
Fail
Receivers treat the record as missing or broken. The report gives the record to publish, fitted to your mail provider when we can detect it.
Not checked
DNS did not answer in time. This never counts as a pass.

Fix the records in this order, because each one builds on the one before.

  1. MX first

    Replies need somewhere to go, and a domain that cannot receive mail looks suspicious.

  2. Then SPF

    One record that names the services you send through, within 10 lookups.

  3. Then DKIM

    Switch signing on at your email provider and publish its key. DMARC relies on it most, because it survives forwarding.

  4. Then DMARC

    Start at p=none with a reports address. Move to p=quarantine when the reports show only your own services.

DNS changes take from a few minutes to a few hours to appear. Run the check again after each change.

LeadTerminal shows the records each sending domain needs before your campaigns use it.

In LeadTerminal, every sending domain lists the DNS records it needs and shows which ones are published. LeadTerminal finds the businesses you want to work with and prepares personalized outreach, sent from domains that are ready.

See the product in actionOutreach examples

Common questions about email domain checks

Is the checker free?

Yes. There is no sign-up. To stop automated use, one connection can run 12 checks a minute.

Does the check send email or contact my mail server?

No. It reads public DNS records only. It does not connect to mail servers, send test messages or query blocklists.

Why does the check find no DKIM key when I have set one up?

DKIM keys sit under a name called a selector, and we try the common ones. If your provider uses a custom selector, look for s= in the DKIM-Signature header of a message you sent: that is your selector.

Should my DMARC policy be none, quarantine or reject?

Start at p=none with a reports address if you are not sure which services send as your domain. When DKIM is on for all of them, move to p=quarantine, and later to p=reject.

What does a good SPF record look like?

One record at the root of the domain that names only the services you send through and ends in ~all or -all. For Google Workspace alone it is v=spf1 include:_spf.google.com ~all, and for Microsoft 365 alone v=spf1 include:spf.protection.outlook.com ~all.

Do you store the domains I check?

No. We use the domain to run the DNS lookups and keep the answer in memory for one minute, so a repeated check is fast. If you type an email address, only the part after @ leaves your browser.

Why does my change not show yet?

DNS servers keep an old answer until the record's time to live (TTL) runs out, often from a few minutes to an hour. Our checker also reuses an answer for one minute. Check again after that.