Free email security tools that show what's actually configured.
Every result shows the record we read, when we read it, and how sure we are. Checks we couldn't run are marked "not tested", never a fake failure.
Want these checks every week? Free Domain Watch emails you when your MX, SPF, DMARC or MTA-STS records change. Free, no account.
Free checks and generators, one goal: mail that arrives and impostors that don't
Check your domain
Email Health Check
Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.
- MX hosts and backup MX
- SPF lookups and policy
- DMARC policy and reporting
- DKIM (common selectors)
- MTA-STS and TLS-RPT
MX Lookup
See where your mail is delivered, spot unfiltered backup MX and broken hosts.
- Priority order
- Host resolution (A/AAAA)
- Null MX
- Unfiltered backup hosts
SPF Checker
Count real DNS lookups, find PermErrors, loops and risky "all" settings.
- Recursive lookup count
- PermError and void lookups
- Duplicate records
- The "all" qualifier
DMARC Checker
Check your policy, reporting and the safe path from p=none to reject.
- Policy and subdomain policy
- Reporting addresses
- Alignment mode
- Path to p=reject
DKIM Checker
Validate DKIM keys by selector, including key type and strength.
- Key found by selector
- Key type and length
- Revoked or test keys
MTA-STS Checker
Fetch and validate your MTA-STS policy, match it to your MX hosts and check TLS-RPT.
- _mta-sts record and policy id
- Policy file over HTTPS
- MX hosts against the policy
- TLS-RPT reporting
BIMI Checker
Check your BIMI record, logo and certificate URLs, and the DMARC policy BIMI needs.
- default._bimi record
- Logo and certificate URLs
- DMARC enforcement BIMI needs
Test and diagnose
Email Deliverability Test
Send one email and see its SPF, DKIM and DMARC results, reverse DNS, blocklists, TLS and spam verdict.
- Send one email, get a report
- SPF, DKIM, DMARC and alignment
- Reverse DNS, blocklists and TLS
- Spam-filter verdict
Bulk Sender Requirements Checker
Check your domain against the Gmail, Yahoo and Outlook.com bulk sender rules that DNS can show, with a checklist per provider.
- Gmail, Yahoo and Outlook.com checklists
- SPF, DKIM and DMARC minimums
- Reverse DNS for your sending IP
- What DNS can't show, explained
Email Header Analyzer
Trace hops and authentication results — runs entirely in your browser.
- Hop-by-hop delays
- SPF, DKIM, DMARC results
- Spam verdict headers
- Runs only in your browser
SMTP Error Code Lookup
Paste a bounce or type a code like 550 5.7.26: plain-English meaning, likely causes and fixes, with sources.
- Paste a bounce or type a code
- Gmail, Microsoft and Yahoo messages
- Causes and fixes for both sides
- Sourced from RFCs and provider docs
Blacklist Checker
Check an IPv4 or IPv6 address, or your mail servers, against public spam blocklists, with policy and delisting links.
- IP or domain (MX servers)
- Public DNS blocklists
- Removal links per list
- Refused lookups shown as not tested
Reverse DNS (PTR) Lookup
Check PTR records, forward-confirmed reverse DNS and generic-looking host names.
- PTR record per IP
- Forward-confirmed reverse DNS
- Generic name heuristic
Generate records
SPF Record Generator
Build a valid SPF record from your mail providers, with a DNS lookup count.
- Common mail providers
- Custom ip4, ip6 and includes
- Lookup count estimate
- Long-record splitting
DMARC Record Generator
Build a DMARC record with the right policy, reporting and alignment settings.
- Policy and subdomain policy
- Report addresses checked
- Alignment and failure options
- RFC 9989 aware
DKIM Key Generator
Create a DKIM key pair and the DNS TXT record for your selector — keys are generated in your browser.
- RSA 2048 (or 1024) and Ed25519 keys
- TXT record name and value
- Split into 255-character strings
- Keys made only in your browser
Reports and reference
DMARC Report Analyzer
Read DMARC aggregate reports (XML, gzip or zip): see who sends as your domain and what fails — runs in your browser.
- XML, .gz and .zip reports
- Sources by IP with SPF/DKIM alignment
- Legitimate failures vs likely spoofing
- Runs only in your browser
SPF records by provider
The exact SPF include for Microsoft 365, Google Workspace, SendGrid and 15 more, with lookup costs.
- Verified on each provider's own docs
- Copy-ready combined records
- DNS-lookup cost per include
DKIM records by provider
The DKIM selectors and record names for Microsoft 365, Google Workspace, Amazon SES and 13 more, with where to turn signing on.
- Verified on each provider's own docs
- CNAME or TXT, and who holds the key
- DMARC alignment notes
How our checks work
Honest results matter more than a pretty grade. Here is exactly what happens when you press the button.
- 01
Live DNS, not a cache of last month
We query public DNS when you ask, with strict timeouts and a lookup budget, and show the raw record next to every verdict.
- 02
Standards, cited
SPF follows RFC 7208, DMARC follows RFC 9989, MTA-STS follows RFC 8461. Findings link to the guide that explains the fix.
- 03
"Unknown" is not "broken"
A DKIM selector we can't guess, or a lookup that times out, is reported as not tested. We never invent a failure to scare you.
- 04
Private by default
Result pages are never indexed. The Header Analyzer, DMARC Report Analyzer and DKIM Key Generator run entirely in your browser, so what you paste or open there never leaves your device.
Questions about the tools
Want the background first? Start with SPF vs DKIM vs DMARC or browse the glossary.
Are these email security tools really free?
Yes. Every check is free, needs no sign-up and asks for no email address. Fair-use limits apply: about 20 checks per minute and 300 per day from one IP address, so the tools stay fast for everyone.
Do you store the domains I check?
No. Our usage log records only which tool ran and the score, never the domain, your IP address or the results. DNS check results are cached for five minutes to keep things fast, and result pages are marked noindex so your checks never appear in search engines. The one exception is the Email Deliverability Test: its report (sender address, sending IP and authentication results, never the message body) is kept for 24 hours so you can open it, then deleted.
Where do the results come from?
We query public DNS live, through public resolvers, with timeouts and a lookup budget. Each result shows the record we read and when. If a lookup times out, we mark the check "not tested" rather than reporting a failure that may not exist.
Can an MX lookup prove my mail is filtered?
No. MX records show where senders deliver mail, not what happens next, and attackers can sometimes connect to your mail server directly. Our guide on direct-to-tenant bypass explains how to close that gap.
Is the email header analyzer private?
Yes. It runs entirely in your browser with JavaScript. The headers you paste are never uploaded to our servers, so you can safely analyze messages that contain internal addresses.