Free tool
Domain Health Checker
Enter your domain to test its email health in seconds. This free domain tester checks SPF, DKIM, DMARC and MX records live and tells you in plain English what to fix.
Checks SPF, DKIM, DMARC and MX records live. Free, no sign-up.
What we check
What the domain health check tests
Four DNS records decide whether receivers can verify mail from your domain and whether it can receive replies. Here is what each one proves, what a failure means and where to fix it.
| Check | What it proves | What a fail means | Fix it |
|---|---|---|---|
| SPF | Which servers may send mail for the domain. | No record gives receivers nothing to check. Two records or more than 10 DNS lookups cause a permanent error. | SPF record checker |
| DKIM | The message was signed by your domain and not changed on the way. | Receivers can't verify the signature. Gmail and Yahoo want SPF or DKIM from everyone, and both from bulk senders. | DKIM setup guide |
| DMARC | SPF or DKIM matches the visible From domain, plus what to do with mail that doesn't. | No policy and no reports. Gmail, Yahoo and Outlook.com require at least p=none from bulk senders. | DMARC checker |
| MX | Where mail for the domain is delivered. | The domain can't receive mail, so replies to your outreach are lost. | Google Workspace MX records |
A Warning is not a failure. DMARC at p=none passes the provider rules but only monitors, and DKIM shows a warning when the key sits at a selector we don't test. A Fail needs fixing before you send at any volume.
Beyond DNS
What affects domain health beyond DNS
Passing all four checks means receivers can verify your mail. Whether they trust it depends on reputation, which comes from how the domain behaves over time.
| Factor | Why it matters | How to keep it healthy |
|---|---|---|
| Blocklists | Spamhaus's Domain Blocklist is checked against domains in headers and in links inside the message, so a listed domain can hurt any email that links to it. | Monitor the major blocklists and fix the cause before asking for removal. |
| Domain age | A new domain has no history. Spamhaus notes that unknown reputations start out as poor by default. | Register outreach domains ahead of time and warm them up before sending at volume. |
| Sending volume | Sudden spikes look like a hijacked account. Google asks senders to ramp up gradually and send at a steady rate. | Increase slowly and cap daily sends. Jetmail recommends about 30 cold emails per mailbox per day. |
| Spam complaints | Gmail and Yahoo require a spam rate below 0.3%. Google recommends staying under 0.1%. | Email relevant contacts only, make opting out easy and watch Google Postmaster Tools. |
| Bounces | Google advises cutting volume when messages bounce or get deferred, then increasing again slowly. | Verify addresses before sending and remove hard bounces right away. |
Fix it
How to fix a failing domain
Work through the records in this order. Each step depends on the one before it, and DMARC only passes once SPF or DKIM does.
Step 1
Run the check
Enter the domain above and note every Fail and Warning.
Step 2
Fix SPF
Keep one v=spf1 record that includes your mail provider and stays under 10 lookups.
Step 3
Publish DKIM
Generate the key in your provider's admin console. Google recommends 2048-bit keys.
Step 4
Add DMARC
Start at p=none with a rua address, then tighten to quarantine and reject.
Step 5
Re-check
Changes show up once the old record's TTL expires. Test again, then keep monitoring.
Skip the DNS work entirely
Requirements
What Gmail, Yahoo and Outlook.com require
The big mailbox providers now enforce authentication for bulk senders. A healthy domain meets all of these, even if you send far less.
| Requirement | Gmail | Yahoo | Outlook.com |
|---|---|---|---|
| SPF and DKIM | SPF or DKIM for all senders; both for bulk | SPF or DKIM for all senders; both for bulk | Both, for bulk senders |
| DMARC | p=none or stricter (bulk) | p=none or stricter, must pass (bulk) | p=none or stricter, aligned (bulk) |
| Spam rate | Below 0.3%; aim for under 0.1% | Below 0.3% | — |
Checklist
Domain health checklist for cold email
- One SPF record per domain, ending in ~all or -all, under 10 DNS lookups.
- A DKIM key published for every service that sends as the domain.
- A DMARC record with a rua address, moving from p=none toward p=reject.
- MX records in place so replies arrive.
- Separate outreach domains, so a reputation problem never reaches your main company domain.
- Gradual volume increases and a spam rate well under 0.1%.
Next, see how the three records fit together in SPF vs DKIM vs DMARC, test where your mail actually lands with an inbox placement test, or read the full email deliverability guide.
Sources: Google email sender guidelines, Yahoo sender best practices, Microsoft: Outlook requirements for high-volume senders, Spamhaus Domain Blocklist, RFC 7208 (SPF).
Get your domain health report
Tell us where to send it. We'll reply with mailbox, domain and DNS recommendations for your sending volume — or start right away and have mailboxes live in minutes.
Where should we send it?
Or see pricing →Frequently asked questions
What does a domain health checker test?
This one looks up four DNS records live: SPF, DKIM, DMARC and MX. Together they decide whether receivers can verify mail from your domain and whether it can receive replies. It does not check blocklists or sender reputation, which build up from how you send.
How do I test my domain's email setup?
Type your domain into the domain tester above and press Check domain. From a terminal you can run "dig TXT yourdomain.com +short" for SPF, "dig TXT _dmarc.yourdomain.com +short" for DMARC and "dig MX yourdomain.com +short" for MX.
Is a domain security check the same thing?
For email, mostly. SPF, DKIM and DMARC are what stop other people sending mail as your domain, and a DMARC policy of quarantine or reject is what actually blocks spoofed mail. A full domain security review also covers things this tool does not check, such as registrar account protection and DNSSEC.
Why does DKIM show a warning when my email works fine?
DKIM keys live at a selector name chosen by your provider. The checker tries the common ones (google, selector1, selector2, default and k1). If your provider uses a custom selector, the key exists but we can't find it. Look up the selector in your provider's admin console.
All four checks pass. Why do my emails still go to spam?
Passing DNS checks means receivers can verify your mail, not that they trust it. Reputation comes from spam complaints, sending volume, bounces and blocklists. Google asks senders to keep their spam rate below 0.3% and recommends staying under 0.1%.
How often should I run a domain health report?
After every DNS change, whenever you add a new tool that sends as your domain, and regularly for outreach domains. Records get overwritten during migrations more often than people expect.