tmailrDeliverability · DNS
Check a domain
Look up the records that decide whether a domain's mail is trusted, and whether anyone else can send as it.
What each record does
The DNS records that decide whether a domain is trusted
A domain's email reputation lives in a few DNS records. Miss one and receivers have less reason to trust your mail; miss the wrong one and anyone can send email as you. Here is what each record this checker looks up is for.
MX
Points to the servers that receive mail for the domain. No MX means the domain cannot accept email at all.
SPF
Lists the servers allowed to send for the domain. Receivers distrust anything from an address not on the list, and the record must stay under ten DNS lookups or it fails with a permanent error.
DMARC
Tells receivers what to do with mail that fails SPF and DKIM, and where to send reports. A policy of p=none reports but protects nothing; p=quarantine or p=reject is what actually stops spoofing.
MTA-STS
Requires that mail to the domain is delivered over TLS, so an attacker cannot quietly downgrade the connection and read the message.
TLS-RPT
Asks receivers to report when TLS delivery to the domain fails, so a broken or downgraded connection does not go unnoticed.
Questions people actually ask
Straight answers
Can someone send email pretending to be my domain?
Unless you publish DMARC with an enforcing policy, yes. SPF and DKIM alone report a problem but do not stop it. A DMARC policy of p=quarantine or p=reject is what tells receivers to actually drop forged mail, and is the core of email spoofing and phishing protection.
Is a DMARC policy of p=none enough?
No. p=none only monitors, it protects nothing. Start there to collect reports, confirm your real senders pass, then move to p=quarantine and finally p=reject. Staying on p=none leaves your domain open to spoofing.
How do I fix a missing or failing SPF record?
Publish a single TXT record listing every service that sends for you, keep it under ten DNS lookups, and end it with -all. More than one SPF record, or going over ten lookups, breaks SPF entirely, which this checker will flag.
What is MTA-STS and do I need it?
MTA-STS lets you require that mail to your domain is delivered over TLS, closing a gap where an attacker can strip the encryption and read or alter messages in transit. TLS reporting (TLS-RPT) tells you when that delivery fails. Neither is mandatory, but both raise the security of mail sent to you.