Email DNS health check
Get a quick, honest picture of whether a domain can receive mail and whether mail claiming to come from it is protected.
How it measures
- MX records are fetched and each exchange (up to five) is resolved to an address.
- The SPF and DMARC checks run exactly as in their dedicated tools and their findings are merged.
- _mta-sts and _smtp._tls TXT records are read for presence only; the MTA-STS policy file is not fetched.
Limits
- DKIM is not checked (selectors are not discoverable).
- No connection is made to the mail servers, so SMTP banners, STARTTLS and certificates are not tested.
- Deliverability also depends on reputation and content, which no DNS check can see.
Troubleshooting
- MX host does not resolve
- Mail to the domain fails or falls back to lower-priority hosts. Fix the A/AAAA record of the exchange or remove the stale MX.
- No MX but SPF present
- A send-only domain is fine, but publish a null MX (0 .) so senders do not try the A record.