What it checks
Mail servers (MX) · Which servers receive the domain's mail, their addresses and reverse DNS.
SPF · Which servers may send email on behalf of the domain. We count DNS lookups the way a mail server does: above 10 SPF fails.
DMARC · What recipients should do with email that fails SPF or DKIM, and where to send reports.
DKIM · The public keys recipients use to verify your email signatures. We try the most common selectors.
MTA-STS · Forces whoever sends you mail to use TLS with a valid certificate, against attacks that strip encryption.
TLS-RPT · Daily reports from large providers about TLS problems when delivering mail to you.
DANE · MX server certificates published in DNS and protected by DNSSEC (TLSA records).
DNSSEC · Cryptographic signature of DNS answers: prevents forging MX and security records.
BIMI · The sender logo shown next to emails in clients that support it.
Blacklists · Whether the MX server IPs (and the ones you enter) or the domain appear in the main anti-spam lists.
Client setup · Records that let mail programs configure themselves.
Where to start
There are three basics: SPF says who may send, DKIM signs the emails, DMARC tells recipients what to do with forged ones. Without all three, Gmail and Microsoft easily put your mail in spam and anyone can pretend to be you. MTA-STS, TLS-RPT and DANE instead protect incoming mail, while BIMI is the icing on the cake: your logo next to your emails.
DNS lookups go through DNS-over-HTTPS (Cloudflare, with Google as fallback). We do not store the domains you check: results stay in a temporary cache for 5 minutes and are then deleted.