Email Deliverability Checker (MX, SPF, DKIM, DMARC)

Check a domain's email authentication in one go: MX, SPF lookup count, DKIM keys on common selectors (Microsoft 365, Google, Mailchimp, SendGrid and more), DMARC policy, plus MTA-STS, TLS-RPT and BIMI. Pass/warn/fail scorecard and an overall grade. Free, no signup.

Enter a domain and click Check deliverability.

How to use it

  1. Enter the domain you send mail from (or an email address; the part after @ is used). If you know your DKIM selector, add it in the optional box (it is the s= value in a DKIM-Signature header).
  2. The checker queries MX, SPF, DMARC, MTA-STS, TLS-RPT and BIMI records and probes about 50 common DKIM selectors (selector1/selector2 for Microsoft 365, google, k1 for Mailchimp, s1/s2 for SendGrid, and so on).
  3. Each check gets PASS, WARN, FAIL or INFO. MX, SPF, DKIM and DMARC drive the grade; MTA-STS, TLS-RPT and BIMI add a little on top.
  4. Fix FAIL rows first, then WARN rows. Use the Details link on each row for the dedicated checker with the full breakdown.
  5. A good grade means your DNS is set up correctly. It does not cover IP reputation, blocklists or message content.

Audit hundreds of domains at once

Need SPF, DMARC and MX checks across a whole client list? Run the Bulk SPF / DMARC / MX Auditor on Apify ($2 per 1,000 domains).

Related email tools

Dig deeper with the MX Lookup, SPF Checker, DKIM Explainer and DMARC Checker, or fix gaps with the SPF Builder, DMARC Generator, MTA-STS, TLS-RPT and BIMI generators.

FAQ

What does an email deliverability check test?

The DNS records receivers use to decide whether to trust your mail: MX (can you receive bounces), SPF (which servers may send), DKIM (signing keys), DMARC (what to do with mail that fails, and where to send reports), plus the optional MTA-STS, TLS-RPT and BIMI records. It does not test IP reputation, blocklists or message content.

Why does the checker say no DKIM key was found when I have DKIM?

DKIM keys live at <selector>._domainkey.<domain>, and DNS cannot list every selector. This page probes about 50 common ones (selector1/selector2 for Microsoft 365, google, k1, s1/s2 and more). If your provider uses a custom or rotating selector, open a received message, find the s= value in the DKIM-Signature header and enter it in the optional box.

What do Google and Yahoo require from bulk senders?

Since 2024, senders of more than 5,000 messages a day to Gmail or Yahoo need SPF and DKIM, a DMARC record (p=none is the minimum), alignment between the From domain and SPF or DKIM, one-click unsubscribe and a low spam rate. All senders need at least SPF or DKIM.

Is a 1024-bit DKIM key still OK?

It still verifies, but 2048-bit RSA is the current recommendation and most providers (Microsoft 365, Google Workspace) now default to it. Keys under 1024 bits are rejected. An empty p= means the key was revoked on purpose.

Do I need MTA-STS, TLS-RPT and BIMI?

No, they are optional and only lightly weighted in the grade. MTA-STS makes senders use verified TLS when delivering to you, TLS-RPT sends you reports when that fails, and BIMI shows your logo in supporting inboxes once DMARC is at quarantine or reject.

Want the full kit?

Runbooks, checklists and helpdesk templates: IT Admin Packs on Gumroad.