Email domain health check

What this catches

Every problem below is one this tool detects and explains, with the record to publish.

• An MX host does not resolve to an address

  A mail exchanger is published but its hostname has no A or AAAA record.

• An MX host resolves to a private address

  A published mail exchanger points into private address space and is unreachable from the internet.

• An MX record points at an alias

  MX targets must be hostnames with address records, not CNAMEs.

• An SPF include could not be resolved

  A referenced record did not return an answer when we checked.

• BIMI is not configured

  No BIMI record, so your logo is not displayed alongside your mail.

• BIMI record is malformed

  The record does not parse as BIMI, so it is ignored.

• BIMI record published without DMARC enforcement

  BIMI requires a DMARC policy of quarantine or reject. The record will be ignored.

• DKIM key has been revoked

  The record exists but its public key is empty, which explicitly revokes the selector.

• DKIM key is 1024 bits

  Acceptable today, but 2048 bits is the current recommendation.

• DKIM key is shorter than 1024 bits

  The RSA key is too short to be considered secure and some receivers reject it.

• DKIM record is malformed

  The record at this selector is not a valid DKIM key record.

• DKIM selector is in testing mode

  The t=y flag tells receivers to ignore DKIM failures for this selector.

• DMARC policy applies to only part of your mail

  The pct tag is below 100, so the policy is applied to a sample of messages.

• DMARC policy is set to none

  The policy monitors but does not act — failing mail is still delivered.

• DMARC record contains a syntax error

  A tag in the DMARC record is malformed, which can invalidate the whole policy.

• DMARC record requests no aggregate reports

  There is no rua address, so you receive no data about who sends as your domain.

• DMARC uses relaxed alignment

  Subdomains of your organisational domain count as aligned. This is the default and is usually correct.

• Domain declares that it does not accept mail

  A null MX record is published, which is the correct way to say so.

• External reporting address is not authorised

  Reports are directed to another domain that has not published the required authorisation record.

• Legacy SPF-type record found

  A record of the obsolete SPF DNS type exists alongside the TXT record.

• More than one DMARC record published

  Multiple DMARC records exist at _dmarc, so receivers ignore the policy entirely.

• More than one SPF record published

  Two or more SPF records exist. Receivers treat this as a permanent error and SPF fails outright.

• MTA-STS is not configured

  The domain does not publish an MTA-STS policy. This is optional but worth having.

• MTA-STS policy does not cover all published mail exchangers

  An MX host in DNS is not listed in the policy file.

• MTA-STS policy is in testing mode

  Failures are reported but not acted on, so the policy is not yet protecting mail.

• MTA-STS record published but the policy file is unreachable

  The DNS record announces a policy that cannot be fetched.

• No DKIM key found at the selectors we checked

  We probed the selectors used by common providers and found no DKIM record.

• No DKIM record at the requested selector

  The selector you asked about does not resolve to a DKIM key.

• No DMARC record found

  There is no DMARC policy at _dmarc for this domain.

• No MX records found

  This domain publishes no mail exchangers, so it cannot receive email.

• No SPF record found

  This domain publishes no SPF record, so receivers have no list of authorised senders.

• Only one mail exchanger is published

  There is no backup path if this host becomes unreachable.

• SPF record contains a syntax error

  Part of the record is not valid SPF, so receivers may reject the whole record.

• SPF record contains lookups that resolve to nothing

  One or more includes point at names that no longer exist.

• SPF record ends with ?all

  The record explicitly takes no position on unlisted senders.

• SPF record ends with +all

  The record authorises the entire internet to send mail as this domain.

• SPF record exceeds the 10 DNS lookup limit

  Evaluating this SPF record needs more than the 10 DNS lookups the specification permits.

• SPF record has mechanisms after the all term

  Terms placed after all are never evaluated.

• SPF record has no all mechanism

  The record does not say what to do about senders it has not listed.

• SPF record is close to the 10 lookup limit

  This record is within one or two lookups of the point where SPF fails permanently.

• SPF record uses the deprecated ptr mechanism

  ptr is slow, unreliable and explicitly discouraged by the specification.

• Subdomain policy is weaker than the domain policy

  sp= is set to a laxer value than p=, leaving subdomains less protected.

• TLS reporting is not configured

  No TLS-RPT record, so you receive no reports about failed encrypted deliveries.

• TLS-RPT record is malformed

  The record exists but does not parse, so reports will not be sent.

Related tools

• SPF checkerLook up a domain's SPF record, validate its syntax, and count the DNS lookups it costs — including every nested include — against the limit of ten.
• DMARC checkerLook up and validate a domain's DMARC record, read back what its policy actually does, and see what is needed to move to enforcement.
• DKIM checkerCheck a DKIM selector for a domain, validate the record, and read the key strength. Leave the selector blank to probe the selectors common providers use.
• MX lookupList a domain's mail exchangers and priorities, confirm each resolves to a reachable address, and catch the misconfigurations that break inbound mail.